| Index: src/ic.cc
|
| diff --git a/src/ic.cc b/src/ic.cc
|
| index 33c09642df6daeb387a34c7f67e5e10fb50bfa37..b080a316531bd333622b67309286d9cefe4ee957 100644
|
| --- a/src/ic.cc
|
| +++ b/src/ic.cc
|
| @@ -1557,12 +1557,13 @@ Handle<Code> StoreIC::CompileStoreHandler(LookupResult* lookup,
|
| DCHECK(holder.is_identical_to(receiver));
|
| return isolate()->builtins()->StoreIC_Normal();
|
| case CALLBACKS: {
|
| - Handle<Object> callback(lookup->GetCallbackObject(), isolate());
|
| + if (!holder->HasFastProperties()) break;
|
| + Handle<Object> callback(lookup->GetValueFromMap(holder->map()),
|
| + isolate());
|
| if (callback->IsExecutableAccessorInfo()) {
|
| Handle<ExecutableAccessorInfo> info =
|
| Handle<ExecutableAccessorInfo>::cast(callback);
|
| if (v8::ToCData<Address>(info->setter()) == 0) break;
|
| - if (!holder->HasFastProperties()) break;
|
| if (!ExecutableAccessorInfo::IsCompatibleReceiverType(
|
| isolate(), info, receiver_type())) {
|
| break;
|
| @@ -1574,8 +1575,6 @@ Handle<Code> StoreIC::CompileStoreHandler(LookupResult* lookup,
|
| Handle<Object> setter(
|
| Handle<AccessorPair>::cast(callback)->setter(), isolate());
|
| if (!setter->IsJSFunction()) break;
|
| - if (holder->IsGlobalObject()) break;
|
| - if (!holder->HasFastProperties()) break;
|
| Handle<JSFunction> function = Handle<JSFunction>::cast(setter);
|
| CallOptimization call_optimization(function);
|
| NamedStoreHandlerCompiler compiler(isolate(), receiver_type(),
|
|
|