Perform HasFastProperties check on prototypes when computing call targets in Crankshaft.

src/ast.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 510 matching lines @@
         case TRANSITION:
         case NONEXISTENT:
           UNREACHABLE();
           break;
       }
     }
     // If we reach the end of the prototype chain, we don't know the target.
     if (!type->prototype()->IsJSObject()) return false;
     // Go up the prototype chain, recording where we are currently.
     holder_ = Handle<JSObject>(JSObject::cast(type->prototype()));
+    if (!holder_->HasFastProperties()) return false;
     type = Handle<Map>(holder()->map());
   }
 }
 
 
 bool Call::ComputeGlobalTarget(Handle<GlobalObject> global,
                                LookupResult* lookup) {
   target_ = Handle<JSFunction>::null();
   cell_ = Handle<JSGlobalPropertyCell>::null();
   ASSERT(lookup->IsFound() &&
@@ skipping 588 matching lines @@
     OS::SNPrintF(buffer, "%d", Smi::cast(*handle_)->value());
     str = arr;
   } else {
     str = DoubleToCString(handle_->Number(), buffer);
   }
   return FACTORY->NewStringFromAscii(CStrVector(str));
 }
 
 
 } }  // namespace v8::internal