Skip the mapcheck on the global object since the global proxy and cell are already checked (or the …

src/ic/x64/handler-compiler-x64.cc

Index: src/ic/x64/handler-compiler-x64.cc
diff --git a/src/ic/x64/handler-compiler-x64.cc b/src/ic/x64/handler-compiler-x64.cc
index 4b066f2d4291e2d2f3f48104c55c515add11ff77..23882dcb5cb8e743828a4813eb8e201e00b6484a 100644
--- a/src/ic/x64/handler-compiler-x64.cc
+++ b/src/ic/x64/handler-compiler-x64.cc
@@ -477,16 +477,15 @@ Register PropertyHandlerCompiler::CheckPrototypes(
       Register map_reg = scratch1;
       __ movp(map_reg, FieldOperand(reg, HeapObject::kMapOffset));
 
-      if (depth != 1 || check == CHECK_ALL_MAPS) {
+      if (current_map->IsJSGlobalObjectMap()) {
+        GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
+                                  name, scratch2, miss);
+      } else if (depth != 1 || check == CHECK_ALL_MAPS) {
         Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
         __ CmpWeakValue(map_reg, cell, scratch2);
         __ j(not_equal, miss);
       }
 
-      if (current_map->IsJSGlobalObjectMap()) {
-        GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
-                                  name, scratch2, miss);
-      }
       reg = holder_reg;  // From now on the object will be in holder_reg.
 
       __ movp(reg, FieldOperand(map_reg, Map::kPrototypeOffset));
@@ -497,6 +496,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
     current_map = handle(current->map());
   }
 
+  DCHECK(!current_map->IsJSGlobalProxyMap());
+
   // Log the check depth.
   LOG(isolate(), IntEvent("check-maps-depth", depth + 1));