Invalidate property cells for non-existent properties properly.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 542b8a0049df836c369b929146697540424c7244..baa1abdc516ba5515e971155ac70da399cfc77e4 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -15334,8 +15334,15 @@ void GlobalObject::InvalidatePropertyCell(Handle<GlobalObject> global,
     Handle<PropertyCell> new_cell = isolate->factory()->NewPropertyCell(value);
     global->property_dictionary()->ValueAtPut(entry, *new_cell);
 
-    Handle<Object> hole = global->GetIsolate()->factory()->the_hole_value();
-    PropertyCell::SetValueInferType(cell, hole);
+    Handle<Object> hole = isolate->factory()->the_hole_value();
+    if (*hole != *value) {
+      PropertyCell::SetValueInferType(cell, hole);
+    } else {
+      // BUG3914: if property value was the hole, set it to any other value,

[Toon Verwaest, 2015/02/24 12:27:52]

I don't think it's worth specially annotating this line with the bug number.
Whoever cares can just look at the CL.

+      // to ensure that LoadNonexistent ICs execute a miss.
+      Handle<Object> undefined = isolate->factory()->undefined_value();
+      PropertyCell::SetValueInferType(cell, undefined);
+    }
   }
 }