Correct handling of arrays with callbacks in the prototype chain.

src/x64/macro-assembler-x64.cc

Index: src/x64/macro-assembler-x64.cc
diff --git a/src/x64/macro-assembler-x64.cc b/src/x64/macro-assembler-x64.cc
index 075f07cc353e991fd7969a49725599cb5fcfd45b..4b8d0621e9db0cd2c33533df66067793ff2702c1 100644
--- a/src/x64/macro-assembler-x64.cc
+++ b/src/x64/macro-assembler-x64.cc
@@ -4967,6 +4967,32 @@ void MacroAssembler::RecordObjectAllocation(Isolate* isolate,
   PopSafepointRegisters();
 }
 
+void MacroAssembler::HasDictionaryInPrototypeChain(
+    Register object,
+    Register elements,
+    Label* found) {
+  Register temp = elements;
+  Label loop_again;
+
+  // scratch contained elements pointer.
+  movq(temp, object);
+
+  // Loop based on the map going up the prototype chain.
+  bind(&loop_again);
+  movq(temp, FieldOperand(temp, HeapObject::kMapOffset));
+  movq(kScratchRegister, FieldOperand(temp, Map::kBitField2Offset));
+  and_(kScratchRegister, Immediate(Map::kElementsKindMask));
+  shr(kScratchRegister, Immediate(Map::kElementsKindShift));
+  cmpq(kScratchRegister, Immediate(DICTIONARY_ELEMENTS));
+  j(equal, found);
+  movq(temp, FieldOperand(temp, Map::kPrototypeOffset));
+  CompareRoot(temp, Heap::kNullValueRootIndex);
+  j(not_equal, &loop_again);
+
+  // Restore elements
+  movq(elements, FieldOperand(object, JSObject::kElementsOffset));

[Michael Starzinger, 2013/11/04 15:18:17]

Instead of specializing the semantics of this function to use the elements
register, let's just pass an arbitrary "scratch" register and let the caller
take care of saving and restoring it. AFAICT "rdi" should still be available as
a true scratch register at both call-sites.

[mvstanton, 2013/11/04 16:30:05]

Thx, done.

+}
+
 
 } }  // namespace v8::internal