| Index: src/ic/arm64/handler-compiler-arm64.cc | 
| diff --git a/src/ic/arm64/handler-compiler-arm64.cc b/src/ic/arm64/handler-compiler-arm64.cc | 
| index 84c0397cd11434fef672956ed579fb6b75768b45..27eafec80085743765e18908f96795bdafb38d06 100644 | 
| --- a/src/ic/arm64/handler-compiler-arm64.cc | 
| +++ b/src/ic/arm64/handler-compiler-arm64.cc | 
| @@ -467,28 +467,25 @@ Register PropertyHandlerCompiler::CheckPrototypes( | 
| DCHECK(!AreAliased(object_reg, scratch1, scratch2)); | 
| DCHECK(!AreAliased(holder_reg, scratch1, scratch2)); | 
|  | 
| -  if (FLAG_eliminate_prototype_chain_checks) { | 
| -    Handle<Cell> validity_cell = | 
| -        Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate()); | 
| -    if (!validity_cell.is_null()) { | 
| -      DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), | 
| -                validity_cell->value()); | 
| -      __ Mov(scratch1, Operand(validity_cell)); | 
| -      __ Ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset)); | 
| -      __ Cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid))); | 
| -      __ B(ne, miss); | 
| -    } | 
| +  Handle<Cell> validity_cell = | 
| +      Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate()); | 
| +  if (!validity_cell.is_null()) { | 
| +    DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), validity_cell->value()); | 
| +    __ Mov(scratch1, Operand(validity_cell)); | 
| +    __ Ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset)); | 
| +    __ Cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid))); | 
| +    __ B(ne, miss); | 
| +  } | 
|  | 
| -    // The prototype chain of primitives (and their JSValue wrappers) depends | 
| -    // on the native context, which can't be guarded by validity cells. | 
| -    // |object_reg| holds the native context specific prototype in this case; | 
| -    // we need to check its map. | 
| -    if (check == CHECK_ALL_MAPS) { | 
| -      __ Ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset)); | 
| -      Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map); | 
| -      __ CmpWeakValue(scratch1, cell, scratch2); | 
| -      __ B(ne, miss); | 
| -    } | 
| +  // The prototype chain of primitives (and their JSValue wrappers) depends | 
| +  // on the native context, which can't be guarded by validity cells. | 
| +  // |object_reg| holds the native context specific prototype in this case; | 
| +  // we need to check its map. | 
| +  if (check == CHECK_ALL_MAPS) { | 
| +    __ Ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset)); | 
| +    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map); | 
| +    __ CmpWeakValue(scratch1, cell, scratch2); | 
| +    __ B(ne, miss); | 
| } | 
|  | 
| // Keep track of the current object in register reg. | 
| @@ -525,8 +522,10 @@ Register PropertyHandlerCompiler::CheckPrototypes( | 
| !current_map->is_access_check_needed()); | 
|  | 
| prototype = handle(JSObject::cast(current_map->prototype())); | 
| -    if (current_map->is_dictionary_map() && | 
| -        !current_map->IsJSGlobalObjectMap()) { | 
| +    if (current_map->IsJSGlobalObjectMap()) { | 
| +      GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current), | 
| +                                name, scratch2, miss); | 
| +    } else if (current_map->is_dictionary_map()) { | 
| DCHECK(!current_map->IsJSGlobalProxyMap());  // Proxy maps are fast. | 
| if (!name->IsUniqueName()) { | 
| DCHECK(name->IsString()); | 
| @@ -535,34 +534,12 @@ Register PropertyHandlerCompiler::CheckPrototypes( | 
| DCHECK(current.is_null() || (current->property_dictionary()->FindEntry( | 
| name) == NameDictionary::kNotFound)); | 
|  | 
| -      if (FLAG_eliminate_prototype_chain_checks && depth > 1) { | 
| +      if (depth > 1) { | 
| // TODO(jkummerow): Cache and re-use weak cell. | 
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss); | 
| } | 
| GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1, | 
| scratch2); | 
| - | 
| -      if (!FLAG_eliminate_prototype_chain_checks) { | 
| -        __ Ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset)); | 
| -        __ Ldr(holder_reg, FieldMemOperand(scratch1, Map::kPrototypeOffset)); | 
| -      } | 
| -    } else { | 
| -      Register map_reg = scratch1; | 
| -      if (!FLAG_eliminate_prototype_chain_checks) { | 
| -        __ Ldr(map_reg, FieldMemOperand(reg, HeapObject::kMapOffset)); | 
| -      } | 
| -      if (current_map->IsJSGlobalObjectMap()) { | 
| -        GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current), | 
| -                                  name, scratch2, miss); | 
| -      } else if (!FLAG_eliminate_prototype_chain_checks && | 
| -                 (depth != 1 || check == CHECK_ALL_MAPS)) { | 
| -        Handle<WeakCell> cell = Map::WeakCellForMap(current_map); | 
| -        __ CmpWeakValue(map_reg, cell, scratch2); | 
| -        __ B(ne, miss); | 
| -      } | 
| -      if (!FLAG_eliminate_prototype_chain_checks) { | 
| -        __ Ldr(holder_reg, FieldMemOperand(map_reg, Map::kPrototypeOffset)); | 
| -      } | 
| } | 
|  | 
| reg = holder_reg;  // From now on the object will be in holder_reg. | 
| @@ -576,17 +553,8 @@ Register PropertyHandlerCompiler::CheckPrototypes( | 
| // Log the check depth. | 
| LOG(isolate(), IntEvent("check-maps-depth", depth + 1)); | 
|  | 
| -  if (!FLAG_eliminate_prototype_chain_checks && | 
| -      (depth != 0 || check == CHECK_ALL_MAPS)) { | 
| -    // Check the holder map. | 
| -    __ Ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset)); | 
| -    Handle<WeakCell> cell = Map::WeakCellForMap(current_map); | 
| -    __ CmpWeakValue(scratch1, cell, scratch2); | 
| -    __ B(ne, miss); | 
| -  } | 
| - | 
| bool return_holder = return_what == RETURN_HOLDER; | 
| -  if (FLAG_eliminate_prototype_chain_checks && return_holder && depth != 0) { | 
| +  if (return_holder && depth != 0) { | 
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss); | 
| } | 
|  | 
|  |