Fix accessor lookup in crankshaft.

Fix accessor lookup in crankshaft.

Seeing monomorphic type feedback plus an AccessorPair does not necessarily imply
that the corresponding getter/setter is really there, so we have to check for
this explictly.

TEST=mjsunit/object-define-property

Committed: https://code.google.com/p/v8/source/detail?r=12317

[Michael Starzinger, 2012-08-16 09:55:58]

LGTM (with a few nits).

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4723: (*accessors)->getter()->IsJSFunction()) {
No need to do open the handle here, that will be done implicitly, just use ...

accessors->getter()->IsJSFunction()

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4724: *getter =
Handle<JSFunction>(JSFunction::cast((*accessors)->getter()));
Likewise.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4737: (*accessors)->setter()->IsJSFunction()) {
Likewise.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4738: *setter =
Handle<JSFunction>(JSFunction::cast((*accessors)->setter()));
Likewise.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:7920: // Because we re-use the load type feedback, there might
be no setter.
We should remove this comment, because there might be no setter for other
reasons as well. This is misleading.

https://chromiumcodereview.appspot.com/10825384/diff/1/test/mjsunit/object-de...
File test/mjsunit/object-define-property.js (right):

https://chromiumcodereview.appspot.com/10825384/diff/1/test/mjsunit/object-de...
test/mjsunit/object-define-property.js:1176: // Test assignment to a getter-only
property on the prototype chain.
Can we extend this comment to say that it actually tests that Crankshaft doesn't
solely rely on type-feedback but rechecks assumptions.

[Sven Panne, 2012-08-16 10:47:40]

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4723: (*accessors)->getter()->IsJSFunction()) {
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> No need to do open the handle here, that will be done implicitly, just use ...
> 
> accessors->getter()->IsJSFunction()

Done.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4724: *getter =
Handle<JSFunction>(JSFunction::cast((*accessors)->getter()));
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> Likewise.

Done.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4737: (*accessors)->setter()->IsJSFunction()) {
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> Likewise.

Done.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:4738: *setter =
Handle<JSFunction>(JSFunction::cast((*accessors)->setter()));
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> Likewise.

Done.

https://chromiumcodereview.appspot.com/10825384/diff/1/src/hydrogen.cc#newcod...
src/hydrogen.cc:7920: // Because we re-use the load type feedback, there might
be no setter.
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> We should remove this comment, because there might be no setter for other
> reasons as well. This is misleading.

Done.

https://chromiumcodereview.appspot.com/10825384/diff/1/test/mjsunit/object-de...
File test/mjsunit/object-define-property.js (right):

https://chromiumcodereview.appspot.com/10825384/diff/1/test/mjsunit/object-de...
test/mjsunit/object-define-property.js:1176: // Test assignment to a getter-only
property on the prototype chain.
On 2012/08/16 09:55:58, Michael Starzinger wrote:
> Can we extend this comment to say that it actually tests that Crankshaft
doesn't
> solely rely on type-feedback but rechecks assumptions.

Done.