Hydrogen: fix keyed loads with string keys

src/ic/ic.cc

Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index 7e7ef15c3d6ddd4da7f7cba6b6e8b1f4dda56bd9..2c386ba6131ce0f70c6e14a1c60e17732b334b91 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -1227,13 +1227,17 @@ static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {
 }
 
 
-Handle<Code> KeyedLoadIC::LoadElementStub(Handle<HeapObject> receiver) {
+Handle<Code> KeyedLoadIC::LoadElementStub(Handle<HeapObject> receiver,
+                                          Handle<Object> key) {
   Handle<Map> receiver_map(receiver->map(), isolate());
   MapHandleList target_receiver_maps;
   TargetMaps(&target_receiver_maps);
 
+  IcCheckType key_type = key->IsString() ? PROPERTY : ELEMENT;

[Jakob Kummerow, 2014/12/10 15:21:18]

This should be key->IsName(). Then again the key is never a name here, so this
entire method doesn't need to be modified.

+
   if (target_receiver_maps.length() == 0) {
-    return PropertyICCompiler::ComputeKeyedLoadMonomorphic(receiver_map);
+    return PropertyICCompiler::ComputeKeyedLoadMonomorphic(receiver_map,
+                                                           key_type);
   }
 
   // The first time a receiver is seen that is a transitioned version of the
@@ -1247,7 +1251,8 @@ Handle<Code> KeyedLoadIC::LoadElementStub(Handle<HeapObject> receiver) {
       IsMoreGeneralElementsKindTransition(
           target_receiver_maps.at(0)->elements_kind(),
           Handle<JSObject>::cast(receiver)->GetElementsKind())) {
-    return PropertyICCompiler::ComputeKeyedLoadMonomorphic(receiver_map);
+    return PropertyICCompiler::ComputeKeyedLoadMonomorphic(receiver_map,
+                                                           key_type);
   }
 
   DCHECK(state() != GENERIC);
@@ -1268,7 +1273,8 @@ Handle<Code> KeyedLoadIC::LoadElementStub(Handle<HeapObject> receiver) {
     return generic_stub();
   }
 
-  return PropertyICCompiler::ComputeKeyedLoadPolymorphic(&target_receiver_maps);
+  return PropertyICCompiler::ComputeKeyedLoadPolymorphic(&target_receiver_maps,
+                                                         key_type);
 }
 
 
@@ -1297,7 +1303,7 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
     if (object->IsJSObject() || (object->IsString() && key->IsNumber())) {
       Handle<HeapObject> receiver = Handle<HeapObject>::cast(object);
       if (object->IsString() || !Object::ToSmi(isolate(), key).is_null()) {
-        stub = LoadElementStub(receiver);
+        stub = LoadElementStub(receiver, key);

[Jakob Kummerow, 2014/12/10 15:21:18]

Look at the conditions above. We only get here if key is a number and fits in a
smi.

       }
     }
   }