| Index: src/ic.cc
|
| diff --git a/src/ic.cc b/src/ic.cc
|
| index cd92af11852c0f77c7140804cf6500e767087474..c46e831dfa419c9133de9b36fb32ce07ba56f3e0 100644
|
| --- a/src/ic.cc
|
| +++ b/src/ic.cc
|
| @@ -11,6 +11,7 @@
|
| #include "src/conversions.h"
|
| #include "src/execution.h"
|
| #include "src/ic-inl.h"
|
| +#include "src/prototype-iterator.h"
|
| #include "src/runtime.h"
|
| #include "src/stub-cache.h"
|
|
|
| @@ -213,7 +214,7 @@ static void LookupForRead(Handle<Object> object,
|
| return;
|
| }
|
|
|
| - Handle<Object> proto(holder->GetPrototype(), lookup->isolate());
|
| + Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*holder), lookup->isolate());
|
| if (proto->IsNull()) {
|
| ASSERT(!lookup->IsFound());
|
| return;
|
| @@ -239,7 +240,7 @@ bool IC::TryRemoveInvalidPrototypeDependentStub(Handle<Object> receiver,
|
| break;
|
| case PROTOTYPE_MAP:
|
| // IC::GetCodeCacheHolder is not applicable.
|
| - if (receiver->GetPrototype(isolate())->IsNull()) return false;
|
| + if (SAFE_GET_PROTOTYPE(isolate(), *receiver)->IsNull()) return false;
|
| break;
|
| }
|
|
|
| @@ -1210,7 +1211,7 @@ static bool LookupForWrite(Handle<JSObject> receiver,
|
| // goes into the runtime if access checks are needed, so this is always
|
| // safe.
|
| if (receiver->IsJSGlobalProxy()) {
|
| - return lookup->holder() == receiver->GetPrototype();
|
| + return lookup->holder() == SAFE_GET_PROTOTYPE_FAST(*receiver);
|
| }
|
| // Currently normal holders in the prototype chain are not supported. They
|
| // would require a runtime positive lookup and verification that the details
|
| @@ -1438,7 +1439,7 @@ Handle<Code> StoreIC::CompileHandler(LookupResult* lookup,
|
| // from the property cell. So the property must be directly on the
|
| // global object.
|
| Handle<GlobalObject> global = receiver->IsJSGlobalProxy()
|
| - ? handle(GlobalObject::cast(receiver->GetPrototype()))
|
| + ? handle(GlobalObject::cast(SAFE_GET_PROTOTYPE_FAST(*receiver)))
|
| : Handle<GlobalObject>::cast(receiver);
|
| Handle<PropertyCell> cell(global->GetPropertyCell(lookup), isolate());
|
| Handle<HeapType> union_type = PropertyCell::UpdatedType(cell, value);
|
|
|