| Index: src/stub-cache.cc
|
| diff --git a/src/stub-cache.cc b/src/stub-cache.cc
|
| index c15038ee9ecc3f13c63ae159a2bea5af453c3262..9ac30d4ecec45fcae79e488482776c3a6365a63b 100644
|
| --- a/src/stub-cache.cc
|
| +++ b/src/stub-cache.cc
|
| @@ -11,6 +11,7 @@
|
| #include "src/cpu-profiler.h"
|
| #include "src/gdb-jit.h"
|
| #include "src/ic-inl.h"
|
| +#include "src/prototype-iterator.h"
|
| #include "src/stub-cache.h"
|
| #include "src/type-info.h"
|
| #include "src/vm-state-inl.h"
|
| @@ -706,8 +707,8 @@ void StubCompiler::LookupPostInterceptor(Handle<JSObject> holder,
|
| LookupResult* lookup) {
|
| holder->LookupOwnRealNamedProperty(name, lookup);
|
| if (lookup->IsFound()) return;
|
| - if (holder->GetPrototype()->IsNull()) return;
|
| - holder->GetPrototype()->Lookup(name, lookup);
|
| + if (SAFE_GET_PROTOTYPE_FAST(*holder)->IsNull()) return;
|
| + SAFE_GET_PROTOTYPE_FAST(*holder)->Lookup(name, lookup);
|
| }
|
|
|
|
|
| @@ -977,7 +978,7 @@ Handle<Code> StoreStubCompiler::CompileStoreTransition(
|
| __ CheckMapDeprecated(transition, scratch1(), &miss);
|
|
|
| // Check that we are allowed to write this.
|
| - if (object->GetPrototype()->IsJSObject()) {
|
| + if (SAFE_GET_PROTOTYPE_FAST(*object)->IsJSObject()) {
|
| Handle<JSObject> holder;
|
| // holder == object indicates that no property was found.
|
| if (lookup->holder() != *object) {
|
| @@ -985,9 +986,12 @@ Handle<Code> StoreStubCompiler::CompileStoreTransition(
|
| } else {
|
| // Find the top object.
|
| holder = object;
|
| - do {
|
| - holder = Handle<JSObject>(JSObject::cast(holder->GetPrototype()));
|
| - } while (holder->GetPrototype()->IsJSObject());
|
| + for (PrototypeIterator<STORE_AS_POINTER, MAP_BASED_WALK,
|
| + END_AT_NULL_VALUE> iter(*holder);
|
| + !iter.IsAtEnd(); iter.Advance()) {
|
| + SLOW_ASSERT(iter.GetCurrent()->IsJSObject());
|
| + holder = Handle<JSObject>(JSObject::cast(iter.GetCurrent()));
|
| + }
|
| }
|
|
|
| Register holder_reg = HandlerFrontendHeader(
|
|
|