correctly invalidate global cells

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/lookup.h"
 #include "src/lookup-inl.h"
@@ skipping 84 matching lines @@
   ReloadPropertyInformation();
 }
 
 
 void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
                                              PropertyAttributes attributes) {
   DCHECK(state_ == DATA || state_ == ACCESSOR);
   DCHECK(HolderIsReceiverOrHiddenPrototype());
   Handle<JSObject> holder = GetHolder<JSObject>();
   if (holder_map_->is_dictionary_map()) {
-    PropertyDetails details(attributes, v8::internal::DATA, 0);
+    PropertyDetails details(attributes, v8::internal::DATA, 0,
+                            PropertyCellType::kMutable);
     JSObject::SetNormalizedProperty(holder, name(), value, details);
   } else {
     holder_map_ = Map::ReconfigureExistingProperty(
         holder_map_, descriptor_number(), i::kData, attributes);
     holder_map_ =
         Map::PrepareForDataProperty(holder_map_, descriptor_number(), value);
     JSObject::MigrateToMap(holder, holder_map_);
   }
 
   ReloadPropertyInformation();
@@ skipping 59 matching lines @@
   holder_ = receiver;
   holder_map_ =
       Map::TransitionToAccessorProperty(handle(receiver->map(), isolate_),
                                         name_, component, accessor, attributes);
   JSObject::MigrateToMap(receiver, holder_map_);
 
   ReloadPropertyInformation();
 
   if (!holder_map_->is_dictionary_map()) return;
 
-  // We have to deoptimize since accesses to data properties may have been
-  // inlined without a corresponding map-check.
-  if (holder_map_->IsGlobalObjectMap()) {
-    Deoptimizer::DeoptimizeGlobalObject(*receiver);
-  }
 
   // Install the accessor into the dictionary-mode object.
-  PropertyDetails details(attributes, ACCESSOR_CONSTANT, 0);
+  PropertyDetails details(attributes, ACCESSOR_CONSTANT, 0,
+                          PropertyCellType::kMutable);
   Handle<AccessorPair> pair;
   if (state() == ACCESSOR && GetAccessors()->IsAccessorPair()) {
     pair = Handle<AccessorPair>::cast(GetAccessors());
     // If the component and attributes are identical, nothing has to be done.
     if (pair->get(component) == *accessor) {
       if (property_details().attributes() == attributes) return;
     } else {
       pair = AccessorPair::Copy(pair);
       pair->set(component, *accessor);
     }
@@ skipping 106 matching lines @@
   DCHECK_EQ(DATA, state_);
   Handle<Object> value = FetchValue();
   return value;
 }
 
 
 Handle<Object> LookupIterator::WriteDataValue(Handle<Object> value) {
   DCHECK_EQ(DATA, state_);
   Handle<JSObject> holder = GetHolder<JSObject>();
   if (holder_map_->is_dictionary_map()) {
-    NameDictionary* property_dictionary = holder->property_dictionary();
+    Handle<NameDictionary> property_dictionary =
+        handle(holder->property_dictionary());
     if (holder->IsGlobalObject()) {
-      Handle<PropertyCell> cell(
-          PropertyCell::cast(property_dictionary->ValueAt(dictionary_entry())));
-      value = PropertyCell::SetValueInferType(cell, value);
+      value = PropertyCell::UpdateCell(property_dictionary, dictionary_entry(),
+                                       value, property_details_);
     } else {
       property_dictionary->ValueAtPut(dictionary_entry(), *value);
     }
   } else if (property_details_.type() == v8::internal::DATA) {
     holder->WriteToField(descriptor_number(), *value);
   } else {
     DCHECK_EQ(v8::internal::DATA_CONSTANT, property_details_.type());
   }
   return value;
 }
@@ skipping 17 matching lines @@
       result ? ExoticIndexState::kIndex : ExoticIndexState::kNoIndex;
   return result;
 }
 
 
 void LookupIterator::InternalizeName() {
   if (name_->IsUniqueName()) return;
   name_ = factory()->InternalizeString(Handle<String>::cast(name_));
 }
 } }  // namespace v8::internal