Correct handling of arrays with callbacks in the prototype chain.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 4bff543a733305ec33c966e5a890195013e538c5..5aa374fdf595f519e469ebbd95a3a3c0a29ba1bb 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1969,18 +1969,34 @@ MaybeObject* KeyedStoreIC::Store(Handle<Object> object,
       ASSERT(!object->IsJSGlobalProxy());
 
       if (miss_mode != MISS_FORCE_GENERIC) {
-        if (object->IsJSObject()) {
-          Handle<JSObject> receiver = Handle<JSObject>::cast(object);
-          bool key_is_smi_like = key->IsSmi() || !key->ToSmi()->IsFailure();
-          if (receiver->elements()->map() ==
-              isolate()->heap()->non_strict_arguments_elements_map()) {
-            stub = non_strict_arguments_stub();
-          } else if (key_is_smi_like &&
-                     (!target().is_identical_to(non_strict_arguments_stub()))) {
-            KeyedAccessStoreMode store_mode =
-                GetStoreMode(receiver, key, value);
-            stub = StoreElementStub(receiver, store_mode);
+        bool indexed_callbacks = false;
+        if (object->IsJSReceiver()) {
+          Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(object);
+          indexed_callbacks =
+              receiver->map()->MayHaveIndexedCallbacksInPrototypeChain();
+        }
+
+        if (!indexed_callbacks) {
+          if (object->IsJSObject()) {

[danno, 2013/10/30 12:17:45]

You should only have to check for JSObject once at this logic below
MISS_FORCE_GENERIC, and then only do the logic below:

if (receiver->map()->MayHaveIndexedCallbacksInPrototypeChain()) {
 ...
}

Might make things a little cleaner.

[mvstanton, 2013/10/30 18:22:28]

Done.

+            Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+            bool key_is_smi_like = key->IsSmi() || !key->ToSmi()->IsFailure();
+            if (receiver->elements()->map() ==
+                isolate()->heap()->non_strict_arguments_elements_map()) {
+              stub = non_strict_arguments_stub();
+            } else if (key_is_smi_like &&
+                       !target().is_identical_to(non_strict_arguments_stub())) {
+              KeyedAccessStoreMode store_mode = GetStoreMode(
+                  receiver, key, value);
+              stub = StoreElementStub(receiver, store_mode);
+            } else {
+              TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "key not a number");

[danno, 2013/10/30 12:17:45]

Remove the TRACE_GENERIC_IC here and below, it's covered by Hannes' new code on
line 2007.

[mvstanton, 2013/10/30 18:22:28]

Okay, it is nice to see the reason for going generic, but I'll go for simplicity
now.

+            }
+          } else {
+            TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "not an object");
           }
+        } else {
+          TRACE_GENERIC_IC(isolate(), "KeyedStoreIC",
+                           "indexed callbacks in prototype chain");
         }
       }
     }
@@ -2270,9 +2286,14 @@ RUNTIME_FUNCTION(MaybeObject*, ElementsTransitionAndStoreIC_Miss) {
   ASSERT(args.length() == 4);
   KeyedStoreIC ic(IC::EXTRA_CALL_FRAME, isolate);
   Handle<Object> value = args.at<Object>(0);
+  Handle<Map> map = args.at<Map>(1);
   Handle<Object> key = args.at<Object>(2);
   Handle<Object> object = args.at<Object>(3);
   StrictModeFlag strict_mode = ic.strict_mode();
+  if (object->IsJSObject()) {
+    JSObject::TransitionElementsKind(Handle<JSObject>::cast(object),
+                                     map->elements_kind());
+  }
   return Runtime::SetObjectProperty(isolate,
                                     object,
                                     key,