Keep prototype maps in dictionary mode until ICs see them

src/runtime/runtime-forin.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/keys.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 namespace {
 
 // Returns either a FixedArray or, if the given {receiver} has an enum cache
 // that contains all enumerable properties of the {receiver} and its prototypes
 // have none, the map of the {receiver}. This is used to speed up the check for
 // deletions during a for-in.
 MaybeHandle<HeapObject> Enumerate(Handle<JSReceiver> receiver) {
   Isolate* const isolate = receiver->GetIsolate();
+  JSObject::MakePrototypesFast(receiver, kStartAtReceiver, isolate);
   FastKeyAccumulator accumulator(isolate, receiver,
                                  KeyCollectionMode::kIncludePrototypes,
                                  ENUMERABLE_STRINGS);
   accumulator.set_filter_proxy_keys(false);
   accumulator.set_is_for_in(true);
   // Test if we have an enum cache for {receiver}.
   if (!accumulator.is_receiver_simple_enum()) {
     Handle<FixedArray> keys;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, keys, accumulator.GetKeys(GetKeysConversion::kKeepNumbers),
@@ skipping 149 matching lines @@
   SealHandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(index, 0);
   DCHECK_LE(0, index);
   DCHECK_LT(index, Smi::kMaxValue);
   return Smi::FromInt(index + 1);
 }
 
 }  // namespace internal
 }  // namespace v8