[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

src/ic/ic-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_INL_H_
 #define V8_IC_INL_H_
 
 #include "src/ic/ic.h"
 
 #include "src/debug/debug.h"
@@ skipping 75 matching lines @@
 
 void IC::set_target(Code* code) {
   SetTargetAtAddress(address(), code, constant_pool());
 }
 
 Code* IC::target() const {
   return GetTargetAtAddress(address(), constant_pool());
 }
 
 bool IC::IsHandler(Object* object) {
-  return (object->IsSmi() && (object != nullptr)) || object->IsTuple3() ||
-         object->IsFixedArray() ||
+  return (object->IsSmi() && (object != nullptr)) || object->IsTuple2() ||
+         object->IsTuple3() || object->IsFixedArray() ||
          (object->IsCode() && Code::cast(object)->is_handler());
 }
 
 Handle<Map> IC::GetHandlerCacheHolder(Handle<Map> receiver_map,
                                       bool receiver_is_holder, Isolate* isolate,
                                       CacheHolderFlag* flag) {
   if (receiver_is_holder) {
     *flag = kCacheOnReceiver;
     return receiver_map;
   }
@@ skipping 40 matching lines @@
 bool IC::AddressIsDeoptimizedCode(Isolate* isolate, Address address) {
   Code* host =
       isolate->inner_pointer_to_code_cache()->GetCacheEntry(address)->code;
   return (host->kind() == Code::OPTIMIZED_FUNCTION &&
           host->marked_for_deoptimization());
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_IC_INL_H_