Update V8 to r5017 as required by WebKit r62496
Change-Id: I1b4b7718d1d77ceef07f543e9150a2cb3a628f3a
diff --git a/src/ic-inl.h b/src/ic-inl.h
index 131f77b..70bbaf8 100644
--- a/src/ic-inl.h
+++ b/src/ic-inl.h
@@ -80,11 +80,38 @@
}
-Map* IC::GetCodeCacheMapForObject(Object* object) {
- if (object->IsJSObject()) return JSObject::cast(object)->map();
+InlineCacheHolderFlag IC::GetCodeCacheForObject(Object* object,
+ JSObject* holder) {
+ if (object->IsJSObject()) {
+ return GetCodeCacheForObject(JSObject::cast(object), holder);
+ }
// If the object is a value, we use the prototype map for the cache.
ASSERT(object->IsString() || object->IsNumber() || object->IsBoolean());
- return JSObject::cast(object->GetPrototype())->map();
+ return PROTOTYPE_MAP;
+}
+
+
+InlineCacheHolderFlag IC::GetCodeCacheForObject(JSObject* object,
+ JSObject* holder) {
+ // Fast-properties and global objects store stubs in their own maps.
+ // Slow properties objects use prototype's map (unless the property is its own
+ // when holder == object). It works because slow properties objects having
+ // the same prototype (or a prototype with the same map) and not having
+ // the property are interchangeable for such a stub.
+ if (holder != object &&
+ !object->HasFastProperties() &&
+ !object->IsJSGlobalProxy() &&
+ !object->IsJSGlobalObject()) {
+ return PROTOTYPE_MAP;
+ }
+ return OWN_MAP;
+}
+
+
+Map* IC::GetCodeCacheMap(Object* object, InlineCacheHolderFlag holder) {
+ Object* map_owner = (holder == OWN_MAP ? object : object->GetPrototype());
+ ASSERT(map_owner->IsJSObject());
+ return JSObject::cast(map_owner)->map();
}