[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast.h"
 #include "src/base/bits.h"
@@ skipping 85 matching lines @@
 Handle<PrototypeInfo> Factory::NewPrototypeInfo() {
   Handle<PrototypeInfo> result =
       Handle<PrototypeInfo>::cast(NewStruct(PROTOTYPE_INFO_TYPE));
   result->set_prototype_users(WeakFixedArray::Empty());
   result->set_registry_slot(PrototypeInfo::UNREGISTERED);
   result->set_validity_cell(Smi::kZero);
   result->set_bit_field(0);
   return result;
 }
 
+Handle<Tuple2> Factory::NewTuple2(Handle<Object> value1,
+                                  Handle<Object> value2) {
+  Handle<Tuple2> result = Handle<Tuple2>::cast(NewStruct(TUPLE2_TYPE));
+  result->set_value1(*value1);
+  result->set_value2(*value2);
+  return result;
+}
+
 Handle<Tuple3> Factory::NewTuple3(Handle<Object> value1, Handle<Object> value2,
                                   Handle<Object> value3) {
   Handle<Tuple3> result = Handle<Tuple3>::cast(NewStruct(TUPLE3_TYPE));
   result->set_value1(*value1);
   result->set_value2(*value2);
   result->set_value3(*value3);
   return result;
 }
 
 Handle<ContextExtension> Factory::NewContextExtension(
@@ skipping 2619 matching lines @@
       Handle<JSFixedArrayIterator>::cast(NewJSObjectFromMap(map));
   iterator->set_initial_next(*next);
   iterator->set_array(*array);
   iterator->set_index(0);
   iterator->InObjectPropertyAtPut(JSFixedArrayIterator::kNextIndex, *next);
   return iterator;
 }
 
 }  // namespace internal
 }  // namespace v8