Vector-based ICs also need to hold maps weakly.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bailout-reason.h"
 #include "src/code-stubs.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
@@ skipping 2025 matching lines @@
   IfBuilder if_receiver_heap_object(this);
   if_receiver_heap_object.IfNot<HIsSmiAndBranch>(receiver);
   if_receiver_heap_object.Then();
   {
     HConstant* constant_two = Add<HConstant>(2);
     HConstant* constant_three = Add<HConstant>(3);
 
     HValue* receiver_map = AddLoadMap(receiver, nullptr);
     HValue* start =
         keyed_load ? graph()->GetConstant1() : graph()->GetConstant0();
-    HValue* array_map = Add<HLoadKeyed>(array, start, nullptr, FAST_ELEMENTS,
+    HValue* weak_cell = Add<HLoadKeyed>(array, start, nullptr, FAST_ELEMENTS,
                                         ALLOW_RETURN_HOLE);
+    // Load the weak cell value. It may be Smi(0), or a map. Compare nonetheless
+    // against the receiver_map.
+    HValue* array_map = Add<HLoadNamedField>(weak_cell, nullptr,
+                                             HObjectAccess::ForWeakCellValue());
+
     IfBuilder if_correct_map(this);
     if_correct_map.If<HCompareObjectEqAndBranch>(receiver_map, array_map);
     if_correct_map.Then();
     { TailCallHandler(receiver, name, array, start, slot, vector); }
     if_correct_map.Else();
     {
       // If our array has more elements, the ic is polymorphic. Look for the
       // receiver map in the rest of the array.
       HValue* length = AddLoadFixedArrayLength(array, nullptr);
       LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement,
                           constant_two);
       start = keyed_load ? constant_three : constant_two;
       HValue* key = builder.BeginBody(start, length, Token::LT);
       {
-        HValue* array_map = Add<HLoadKeyed>(array, key, nullptr, FAST_ELEMENTS,
+        HValue* weak_cell = Add<HLoadKeyed>(array, key, nullptr, FAST_ELEMENTS,
                                             ALLOW_RETURN_HOLE);
+        HValue* array_map = Add<HLoadNamedField>(
+            weak_cell, nullptr, HObjectAccess::ForWeakCellValue());
         IfBuilder if_correct_poly_map(this);
         if_correct_poly_map.If<HCompareObjectEqAndBranch>(receiver_map,
                                                           array_map);
         if_correct_poly_map.Then();
         { TailCallHandler(receiver, name, array, key, slot, vector); }
       }
       builder.EndBody();
     }
     if_correct_map.End();
   }
@@ skipping 126 matching lines @@
   // megamorphic case is handled as part of the default stub.
   DCHECK(!FLAG_vector_ics);
 
   // Probe the stub cache.
   Add<HTailCallThroughMegamorphicCache>(receiver, name);
 
   // We never continue.
   return graph()->GetConstant0();
 }
 } }  // namespace v8::internal