| Index: src/ic.cc
|
| diff --git a/src/ic.cc b/src/ic.cc
|
| index 2b9e29c3c1bf78b8abab0cf23c686f67ffaf5e48..c9a741b2a97cbeeaa241c4e1dc18536c59a328c3 100644
|
| --- a/src/ic.cc
|
| +++ b/src/ic.cc
|
| @@ -223,13 +223,13 @@ static void LookupForRead(Handle<Object> object,
|
| return;
|
| }
|
|
|
| - Handle<Object> proto(holder->GetPrototype(), lookup->isolate());
|
| - if (proto->IsNull()) {
|
| + PrototypeIterator iter(lookup->isolate(), holder);
|
| + if (iter.IsAtEnd()) {
|
| ASSERT(!lookup->IsFound());
|
| return;
|
| }
|
|
|
| - object = proto;
|
| + object = PrototypeIterator::GetCurrent(iter);
|
| }
|
| }
|
|
|
| @@ -1236,7 +1236,8 @@ static bool LookupForWrite(Handle<JSObject> receiver,
|
| // goes into the runtime if access checks are needed, so this is always
|
| // safe.
|
| if (receiver->IsJSGlobalProxy()) {
|
| - return lookup->holder() == receiver->GetPrototype();
|
| + PrototypeIterator iter(lookup->isolate(), receiver);
|
| + return lookup->holder() == *PrototypeIterator::GetCurrent(iter);
|
| }
|
| // Currently normal holders in the prototype chain are not supported. They
|
| // would require a runtime positive lookup and verification that the details
|
| @@ -1456,9 +1457,12 @@ Handle<Code> StoreIC::CompileHandler(LookupResult* lookup,
|
| // The stub generated for the global object picks the value directly
|
| // from the property cell. So the property must be directly on the
|
| // global object.
|
| - Handle<GlobalObject> global = receiver->IsJSGlobalProxy()
|
| - ? handle(GlobalObject::cast(receiver->GetPrototype()))
|
| - : Handle<GlobalObject>::cast(receiver);
|
| + PrototypeIterator iter(isolate(), receiver);
|
| + Handle<GlobalObject> global =
|
| + receiver->IsJSGlobalProxy()
|
| + ? Handle<GlobalObject>::cast(
|
| + PrototypeIterator::GetCurrent(iter))
|
| + : Handle<GlobalObject>::cast(receiver);
|
| Handle<PropertyCell> cell(global->GetPropertyCell(lookup), isolate());
|
| Handle<HeapType> union_type = PropertyCell::UpdatedType(cell, value);
|
| StoreGlobalStub stub(
|
|
|