[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

src/type-feedback-vector.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_FEEDBACK_VECTOR_H_
 #define V8_TYPE_FEEDBACK_VECTOR_H_
 
 #include <vector>
 
 #include "src/base/logging.h"
@@ skipping 246 matching lines @@
 
   DECLARE_PRINTER(TypeFeedbackVector)
 
   // Clears the vector slots.
   void ClearSlots(SharedFunctionInfo* shared) { ClearSlotsImpl(shared, true); }
 
   void ClearSlotsAtGCTime(SharedFunctionInfo* shared) {
     ClearSlotsImpl(shared, false);
   }
 
-  static void ClearAllKeyedStoreICs(Isolate* isolate);
-  void ClearKeyedStoreICs(SharedFunctionInfo* shared);
-
   // The object that indicates an uninitialized cache.
   static inline Handle<Symbol> UninitializedSentinel(Isolate* isolate);
 
   // The object that indicates a megamorphic state.
   static inline Handle<Symbol> MegamorphicSentinel(Isolate* isolate);
 
   // The object that indicates a premonomorphic state.
   static inline Handle<Symbol> PremonomorphicSentinel(Isolate* isolate);
 
   // A raw version of the uninitialized sentinel that's safe to read during
@@ skipping 319 matching lines @@
   void Clear(Code* host);
 
   // name can be a null handle for element loads.
   void ConfigureMonomorphic(Handle<Name> name, Handle<Map> receiver_map,
                             Handle<Object> handler);
   // name can be null.
   void ConfigurePolymorphic(Handle<Name> name, MapHandleList* maps,
                             List<Handle<Object>>* handlers);
   void ConfigurePolymorphic(MapHandleList* maps,
                             MapHandleList* transitioned_maps,
-                            CodeHandleList* handlers);
+                            List<Handle<Object>>* handlers);
   void ConfigureMegamorphicKeyed(IcCheckType property_type);
 
   KeyedAccessStoreMode GetKeyedAccessStoreMode() const;
   IcCheckType GetKeyType() const;
 
   InlineCacheState StateFromFeedback() const override;
   Name* FindFirstName() const override;
 };
 
 class BinaryOpICNexus final : public FeedbackNexus {
@@ skipping 58 matching lines @@
   }
 };
 
 inline BinaryOperationHint BinaryOperationHintFromFeedback(int type_feedback);
 inline CompareOperationHint CompareOperationHintFromFeedback(int type_feedback);
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TRANSITIONS_H_