| Index: src/hydrogen.cc
|
| diff --git a/src/hydrogen.cc b/src/hydrogen.cc
|
| index a2f63202b3296d5a0f30538b4818d908c164036e..9224332324707ff6c2cd734a5d4c167bd1d700f2 100644
|
| --- a/src/hydrogen.cc
|
| +++ b/src/hydrogen.cc
|
| @@ -6757,9 +6757,10 @@ HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
|
| // changes could allow callbacks on elements in the chain that
|
| // aren't compatible with monomorphic keyed stores.
|
| Handle<JSObject> prototype(JSObject::cast(map->prototype()));
|
| - JSObject* holder = JSObject::cast(map->prototype());
|
| - while (!holder->GetPrototype()->IsNull()) {
|
| - holder = JSObject::cast(holder->GetPrototype());
|
| + JSObject* holder = NULL;
|
| + for (PrototypeIterator<STORE_AS_POINTER, MAP_BASED_WALK, END_AT_NULL_VALUE>
|
| + iter(*prototype); !iter.IsAtEnd(); iter.Advance()) {
|
| + holder = JSObject::cast(iter.GetCurrent());
|
| }
|
|
|
| BuildCheckPrototypeMaps(prototype,
|
| @@ -7237,7 +7238,7 @@ HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
|
| Handle<JSObject> holder) {
|
| while (holder.is_null() || !prototype.is_identical_to(holder)) {
|
| BuildConstantMapCheck(prototype);
|
| - Object* next_prototype = prototype->GetPrototype();
|
| + Object* next_prototype = SAFE_GET_PROTOTYPE_FAST(*prototype);
|
| if (next_prototype->IsNull()) return NULL;
|
| CHECK(next_prototype->IsJSObject());
|
| prototype = handle(JSObject::cast(next_prototype));
|
|
|