Index: src/ic.cc |
diff --git a/src/ic.cc b/src/ic.cc |
index 33c09642df6daeb387a34c7f67e5e10fb50bfa37..b080a316531bd333622b67309286d9cefe4ee957 100644 |
--- a/src/ic.cc |
+++ b/src/ic.cc |
@@ -1557,12 +1557,13 @@ Handle<Code> StoreIC::CompileStoreHandler(LookupResult* lookup, |
DCHECK(holder.is_identical_to(receiver)); |
return isolate()->builtins()->StoreIC_Normal(); |
case CALLBACKS: { |
- Handle<Object> callback(lookup->GetCallbackObject(), isolate()); |
+ if (!holder->HasFastProperties()) break; |
+ Handle<Object> callback(lookup->GetValueFromMap(holder->map()), |
+ isolate()); |
if (callback->IsExecutableAccessorInfo()) { |
Handle<ExecutableAccessorInfo> info = |
Handle<ExecutableAccessorInfo>::cast(callback); |
if (v8::ToCData<Address>(info->setter()) == 0) break; |
- if (!holder->HasFastProperties()) break; |
if (!ExecutableAccessorInfo::IsCompatibleReceiverType( |
isolate(), info, receiver_type())) { |
break; |
@@ -1574,8 +1575,6 @@ Handle<Code> StoreIC::CompileStoreHandler(LookupResult* lookup, |
Handle<Object> setter( |
Handle<AccessorPair>::cast(callback)->setter(), isolate()); |
if (!setter->IsJSFunction()) break; |
- if (holder->IsGlobalObject()) break; |
- if (!holder->HasFastProperties()) break; |
Handle<JSFunction> function = Handle<JSFunction>::cast(setter); |
CallOptimization call_optimization(function); |
NamedStoreHandlerCompiler compiler(isolate(), receiver_type(), |