Handle non-JSObject heap objects using slow-path IC stub guarded by the map.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index af0a8911c873bfeff4a74b79cca91d109ccef6a2..16a71f9ae05a731185baa7cd279c2db96641f1c8 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1790,6 +1790,10 @@ class HeapObject: public Object {
 
   STATIC_CHECK(kMapOffset == Internals::kHeapObjectMapOffset);
 
+  static void UpdateMapCodeCache(Handle<HeapObject> object,

[Michael Starzinger, 2013/09/12 14:28:48]

Please move this up a few lines to above the casting method. Also add a short
one-liner commment describing this method.

[Toon Verwaest, 2013/09/12 14:58:23]

Done.

+                                 Handle<Name> name,
+                                 Handle<Code> code);
+
  protected:
   // helpers for calling an ObjectVisitor to iterate over pointers in the
   // half-open range [start, end) specified as integer offsets
@@ -2574,10 +2578,6 @@ class JSObject: public JSReceiver {
 
   MUST_USE_RESULT MaybeObject* NormalizeElements();
 
-  static void UpdateMapCodeCache(Handle<JSObject> object,
-                                 Handle<Name> name,
-                                 Handle<Code> code);
-
   // Transform slow named properties to fast variants.
   // Returns failure if allocation failed.
   static void TransformToFastProperties(Handle<JSObject> object,
@@ -5492,6 +5492,8 @@ class Map: public HeapObject {
     set_bit_field(bit_field() | (1 << kIsUndetectable));
   }
 
+  inline bool is_jsobject_map();

[Michael Starzinger, 2013/09/12 14:28:48]

I think starting to duplicate type checking predicates on Map is not good
(especially with a completely new naming convention). I would rather have this
predicate be inlined into CanInlinePropertyAccess directly.

[Toon Verwaest, 2013/09/12 14:58:23]

Done.

+
   inline bool is_undetectable() {
     return ((1 << kIsUndetectable) & bit_field()) != 0;
   }