Ensure slow properties for simple {__proto__:null} literals.

src/ast/ast.h

Index: src/ast/ast.h
diff --git a/src/ast/ast.h b/src/ast/ast.h
index 81a98b641d74498d8a7c554b451a2a1c5f48325e..7627ea47e4fa151658eef01ea2f263ea2b972324 100644
--- a/src/ast/ast.h
+++ b/src/ast/ast.h
@@ -1421,6 +1421,13 @@ class ObjectLiteral final : public MaterializedLiteral {
     return depth() == 1 && !has_elements() && !may_store_doubles();
   }
 
+  bool HasOnlyNullPrototype() const {
+    if (is_simple() || properties_count() != 0) return false;

[adamk, 2016/10/25 11:14:24]

I don't think properties_count() gives you the right answer...why not just check
for properties()->length() == 1?

[Camillo Bruni, 2017/03/13 17:21:44]

That's probably easier, right.

+    const ObjectLiteral::Property* property = properties()->at(0);
+    if (property->kind() != ObjectLiteral::Property::PROTOTYPE) return false;
+    return property->value()->IsNullLiteral();
+  }
+
   // Decide if a property should be in the object boilerplate.
   static bool IsBoilerplateProperty(Property* property);
 
@@ -1434,7 +1441,11 @@ class ObjectLiteral final : public MaterializedLiteral {
 
   // Assemble bitfield of flags for the CreateObjectLiteral helper.
   int ComputeFlags(bool disable_mementos = false) const {
-    int flags = fast_elements() ? kFastElements : kNoFlags;
+    int flags = kNoFlags;
+    // Use slow properties if we only set the null prototype.
+    if (fast_elements() && !HasOnlyNullPrototype()) {
+      flags = kFastElements;
+    }
     if (has_shallow_properties()) {
       flags |= kShallowProperties;
     }