Reland 'Do not embed constant functions in StoreTransition stub.'

src/ic/handler-compiler.cc

Index: src/ic/handler-compiler.cc
diff --git a/src/ic/handler-compiler.cc b/src/ic/handler-compiler.cc
index 9915ed11dcb302c238104f6b23883edf30c0d90c..fe451fd6c22d62378275808fdd182d412aeedc22 100644
--- a/src/ic/handler-compiler.cc
+++ b/src/ic/handler-compiler.cc
@@ -330,7 +330,7 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
   }
 
   int descriptor = transition->LastAdded();
-  DescriptorArray* descriptors = transition->instance_descriptors();
+  Handle<DescriptorArray> descriptors(transition->instance_descriptors());

[ulan, 2014/12/09 17:30:37]

This is the only diff from the original CL. We need to use handle here because
GenerateRestoreMap below can cause GC.

   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   DCHECK(!representation.IsNone());
@@ -340,9 +340,10 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
 
   // Call to respective StoreTransitionStub.
   if (details.type() == CONSTANT) {
-    GenerateConstantCheck(descriptors->GetValue(descriptor), value(), &miss);
-
     GenerateRestoreMap(transition, scratch2(), &miss);
+    DCHECK(descriptors->GetValue(descriptor)->IsJSFunction());
+    Register map_reg = StoreTransitionDescriptor::MapRegister();
+    GenerateConstantCheck(map_reg, descriptor, value(), scratch2(), &miss);
     GenerateRestoreName(name);
     StoreTransitionStub stub(isolate());
     GenerateTailCall(masm(), stub.GetCode());