[ic] Support negative lookup on receiver in data handlers.

src/ic/ic.cc

Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index a4ccc489aad30e1c1678771a56aed9cc610d31d7..502d9e2056b92e4582c47a80291b762c7aaea782 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -852,8 +852,7 @@ bool LoadIC::IsPrototypeValidityCellCheckEnough(Handle<Map> receiver_map,
 
   // The following kinds of receiver maps require custom handler compilation.
   if (receiver_map->IsPrimitiveMap() || receiver_map->IsJSGlobalProxyMap() ||
-      receiver_map->IsJSGlobalObjectMap() ||
-      receiver_map->is_dictionary_map()) {
+      receiver_map->IsJSGlobalObjectMap()) {
     return false;
   }
 
@@ -863,12 +862,12 @@ bool LoadIC::IsPrototypeValidityCellCheckEnough(Handle<Map> receiver_map,
     JSObject* current = iter.GetCurrent<JSObject>();
     if (current == *holder) break;
     Map* current_map = current->map();
-    if (current_map->IsJSGlobalObjectMap() ||
-        current_map->IsJSGlobalProxyMap() || current_map->is_dictionary_map()) {
+    if (current_map->IsJSGlobalObjectMap()) {
+      return false;
+    } else if (current_map->is_dictionary_map()) {
+      DCHECK(!current_map->IsJSGlobalProxyMap());  // Proxy maps are fast.
       return false;
     }
-    // Only objects that do not require access checks are allowed in stubs.
-    DCHECK(!current_map->is_access_check_needed());
   }
   return true;
 }
@@ -878,6 +877,14 @@ Handle<Object> LoadIC::SimpleLoadFromPrototype(Handle<Map> receiver_map,
                                                Handle<Object> smi_handler) {
   DCHECK(IsPrototypeValidityCellCheckEnough(receiver_map, holder));
 
+  if (receiver_map->IsJSGlobalProxyMap() ||
+      receiver_map->IsJSGlobalObjectMap()) {
+    UNREACHABLE();
+  } else if (receiver_map->is_dictionary_map()) {
+    smi_handler =
+        LoadHandler::EnableNegativeLookupOnReceiver(isolate(), smi_handler);
+  }
+
   Handle<Cell> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   DCHECK(!validity_cell.is_null());