Use Cells to check prototype chain validity (disabled by default).

src/ic/handler-compiler.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_HANDLER_COMPILER_H_
 #define V8_IC_HANDLER_COMPILER_H_
 
 #include "src/ic/access-compiler.h"
 #include "src/ic/ic-state.h"
 
 namespace v8 {
 namespace internal {
 
 class CallOptimization;
 
 enum PrototypeCheckType { CHECK_ALL_MAPS, SKIP_RECEIVER };
+enum ReturnHolder { RETURN_HOLDER, DONT_RETURN_ANYTHING };
 
 class PropertyHandlerCompiler : public PropertyAccessCompiler {
  public:
   static Handle<Code> Find(Handle<Name> name, Handle<Map> map, Code::Kind kind,
                            CacheHolderFlag cache_holder, Code::StubType type);
 
  protected:
   PropertyHandlerCompiler(Isolate* isolate, Code::Kind kind, Handle<Map> map,
                           Handle<JSObject> holder, CacheHolderFlag cache_holder)
       : PropertyAccessCompiler(isolate, kind, cache_holder),
         map_(map),
         holder_(holder) {}
 
   virtual ~PropertyHandlerCompiler() {}
 
   virtual Register FrontendHeader(Register object_reg, Handle<Name> name,
-                                  Label* miss) {
+                                  Label* miss, ReturnHolder return_what) {
     UNREACHABLE();
     return receiver();
   }
 
   virtual void FrontendFooter(Handle<Name> name, Label* miss) { UNREACHABLE(); }
 
   // Frontend loads from receiver(), returns holder register which may be
   // different.
   Register Frontend(Handle<Name> name);
   void NonexistentFrontendHeader(Handle<Name> name, Label* miss,
@@ skipping 44 matching lines @@
   // code for security check in case of global object holders. Helps to make
   // sure that the current IC is still valid.
   //
   // The scratch and holder registers are always clobbered, but the object
   // register is only clobbered if it the same as the holder register. The
   // function returns a register containing the holder - either object_reg or
   // holder_reg.
   Register CheckPrototypes(Register object_reg, Register holder_reg,
                            Register scratch1, Register scratch2,
                            Handle<Name> name, Label* miss,
-                           PrototypeCheckType check = CHECK_ALL_MAPS);
+                           PrototypeCheckType check, ReturnHolder return_what);
 
   Handle<Code> GetCode(Code::Kind kind, Code::StubType type, Handle<Name> name);
   void set_holder(Handle<JSObject> holder) { holder_ = holder; }
   Handle<Map> map() const { return map_; }
   void set_map(Handle<Map> map) { map_ = map; }
   Handle<JSObject> holder() const { return holder_; }
 
  private:
   Handle<Map> map_;
   Handle<JSObject> holder_;
@@ skipping 56 matching lines @@
   // stack. The arguments are pushed by the (platform-specific)
   // PushInterceptorArguments and read by LoadPropertyWithInterceptorOnly and
   // LoadWithInterceptor.
   static const int kInterceptorArgsNameIndex = 0;
   static const int kInterceptorArgsThisIndex = 1;
   static const int kInterceptorArgsHolderIndex = 2;
   static const int kInterceptorArgsLength = 3;
 
  protected:
   virtual Register FrontendHeader(Register object_reg, Handle<Name> name,
-                                  Label* miss);
+                                  Label* miss, ReturnHolder return_what);
 
   virtual void FrontendFooter(Handle<Name> name, Label* miss);
 
  private:
   Handle<Code> CompileLoadNonexistent(Handle<Name> name);
   void GenerateLoadConstant(Handle<Object> value);
   void GenerateLoadCallback(Register reg,
                             Handle<ExecutableAccessorInfo> callback);
   void GenerateLoadCallback(const CallOptimization& call_optimization,
                             Handle<Map> receiver_map);
@@ skipping 53 matching lines @@
 
   static void GenerateStoreViaSetterForDeopt(MacroAssembler* masm) {
     GenerateStoreViaSetter(masm, Handle<Map>::null(), no_reg, no_reg, -1, -1,
                            no_reg);
   }
 
   static void GenerateSlow(MacroAssembler* masm);
 
  protected:
   virtual Register FrontendHeader(Register object_reg, Handle<Name> name,
-                                  Label* miss);
+                                  Label* miss, ReturnHolder return_what);
 
   virtual void FrontendFooter(Handle<Name> name, Label* miss);
   void GenerateRestoreName(Label* label, Handle<Name> name);
 
  private:
   void GenerateRestoreName(Handle<Name> name);
   void GenerateRestoreMap(Handle<Map> transition, Register scratch,
                           Label* miss);
 
   void GenerateConstantCheck(Register map_reg, int descriptor,
@@ skipping 30 matching lines @@
 
   void CompileElementHandlers(MapHandleList* receiver_maps,
                               CodeHandleList* handlers);
 
   static void GenerateStoreSlow(MacroAssembler* masm);
 };
 }
 }  // namespace v8::internal
 
 #endif  // V8_IC_HANDLER_COMPILER_H_