Keep prototype maps in dictionary mode until ICs see them

src/runtime/runtime-forin.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 92 matching lines @@
   return HasEnumerableProperty(isolate, receiver, key);
 }
 
 }  // namespace
 
 
 RUNTIME_FUNCTION(Runtime_ForInEnumerate) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+  JSObject::MakePrototypesFast(receiver, true /* include_receiver */, isolate);

[Toon Verwaest, 2016/06/07 14:48:06]

Given all these /* include_receiver */, what about just adding an enum?

[Jakob Kummerow, 2016/06/08 12:19:00]

Done.

   RETURN_RESULT_OR_FAILURE(isolate, Enumerate(receiver));
 }
 
 
 RUNTIME_FUNCTION_RETURN_TRIPLE(Runtime_ForInPrepare) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   Handle<JSReceiver> receiver = args.at<JSReceiver>(0);
   Handle<Object> cache_type;
   if (!Enumerate(receiver).ToHandle(&cache_type)) {
@@ skipping 61 matching lines @@
   SealHandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(index, 0);
   DCHECK_LE(0, index);
   DCHECK_LT(index, Smi::kMaxValue);
   return Smi::FromInt(index + 1);
 }
 
 }  // namespace internal
 }  // namespace v8