Fix improved LoadICs for dictionaries with callbacks.

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 14708 matching lines @@
       env->Global()->Get(v8::String::New("foo")));
   v8::Local<v8::Function> bar = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("bar")));
   CHECK_EQ(script->Id(), foo->GetScriptId());
   CHECK_EQ(script->Id(), bar->GetScriptId());
 }
 
 
 static v8::Handle<Value> GetterWhichReturns42(Local<String> name,
                                               const AccessorInfo& info) {
+  CHECK(v8::Utils::OpenHandle(*info.This())->IsJSObject());
+  CHECK(v8::Utils::OpenHandle(*info.Holder())->IsJSObject());
   return v8_num(42);
 }
 
 
 static void SetterWhichSetsYOnThisTo23(Local<String> name,
                                        Local<Value> value,
                                        const AccessorInfo& info) {
+  CHECK(v8::Utils::OpenHandle(*info.This())->IsJSObject());
+  CHECK(v8::Utils::OpenHandle(*info.Holder())->IsJSObject());
   info.This()->Set(v8_str("y"), v8_num(23));
 }
 
 
 Handle<Value> FooGetInterceptor(Local<String> name,
                                 const AccessorInfo& info) {
+  CHECK(v8::Utils::OpenHandle(*info.This())->IsJSObject());
+  CHECK(v8::Utils::OpenHandle(*info.Holder())->IsJSObject());
   if (!name->Equals(v8_str("foo"))) return Handle<Value>();
   return v8_num(42);
 }
 
 
 Handle<Value> FooSetInterceptor(Local<String> name,
                                 Local<Value> value,
                                 const AccessorInfo& info) {
+  CHECK(v8::Utils::OpenHandle(*info.This())->IsJSObject());
+  CHECK(v8::Utils::OpenHandle(*info.Holder())->IsJSObject());
   if (!name->Equals(v8_str("foo"))) return Handle<Value>();
   info.This()->Set(v8_str("y"), v8_num(23));
   return v8_num(23);
 }
 
 
 TEST(SetterOnConstructorPrototype) {
   v8::HandleScope scope;
   Local<ObjectTemplate> templ = ObjectTemplate::New();
   templ->SetAccessor(v8_str("x"),
@@ skipping 2301 matching lines @@
   CompileRun("function load(x) { return x.foo; }"
              "function store(x) { x.foo = void 0; }"
              "function keyed_load(x, key) { return x[key]; }"
              // Second version of function has a different source (add void 0)
              // so that it does not share code with the first version.  This
              // ensures that the ICs are monomorphic.
              "function load2(x) { void 0; return x.foo; }"
              "function store2(x) { void 0; x.foo = void 0; }"
              "function keyed_load2(x, key) { void 0; return x[key]; }"
 
+             "obj.y = void 0;"
              "obj.__proto__ = null;"
              "var subobj = {};"
+             "subobj.y = void 0;"
              "subobj.__proto__ = obj;"
              "%OptimizeObjectForAddingMultipleProperties(obj, 1);"
 
              // Make the ICs monomorphic.
              "load(obj); load(obj);"
              "load2(subobj); load2(subobj);"
+             "store(obj); store(obj);"
+             "store2(subobj); store2(subobj);"
+             "keyed_load(obj, 'foo'); keyed_load(obj, 'foo');"
+             "keyed_load2(subobj, 'foo'); keyed_load2(subobj, 'foo');"
+
+             // Actually test the shiny new ICs and better not crash. This
+             // serves as a regression test for issue 142088 as well.
+             "load(obj);"
+             "load2(subobj);"
              "store(obj);"
              "store2(subobj);"
-             "keyed_load(obj, 'foo'); keyed_load(obj, 'foo');"
-             "keyed_load2(subobj, 'foo'); keyed_load2(subobj, 'foo');"
+             "keyed_load(obj, 'foo');"
+             "keyed_load2(subobj, 'foo');"
 
              // Delete the accessor.  It better not be called any more now.
              "delete obj.foo;"
              "obj.y = void 0;"
              "subobj.y = void 0;"
 
              "var load_result = load(obj);"
              "var load_result2 = load2(subobj);"
              "var keyed_load_result = keyed_load(obj, 'foo');"
              "var keyed_load_result2 = keyed_load2(subobj, 'foo');"
              "store(obj);"
              "store2(subobj);"
              "var y_from_obj = obj.y;"
              "var y_from_subobj = subobj.y;");
   CHECK(context->Global()->Get(v8_str("load_result"))->IsUndefined());
   CHECK(context->Global()->Get(v8_str("load_result2"))->IsUndefined());
   CHECK(context->Global()->Get(v8_str("keyed_load_result"))->IsUndefined());
   CHECK(context->Global()->Get(v8_str("keyed_load_result2"))->IsUndefined());
   CHECK(context->Global()->Get(v8_str("y_from_obj"))->IsUndefined());
   CHECK(context->Global()->Get(v8_str("y_from_subobj"))->IsUndefined());
 }
 
 
+THREADED_TEST(Regress142088) {
+  i::FLAG_allow_natives_syntax = true;
+  v8::HandleScope scope;
+  LocalContext context;
+  Local<ObjectTemplate> templ = ObjectTemplate::New();
+  templ->SetAccessor(v8_str("foo"),
+                     GetterWhichReturns42,
+                     SetterWhichSetsYOnThisTo23);
+  context->Global()->Set(v8_str("obj"), templ->NewInstance());
+
+  CompileRun("function load(x) { return x.foo; }"
+             "var o = Object.create(obj);"
+             "%OptimizeObjectForAddingMultipleProperties(obj, 1);"
+             "load(o); load(o); load(o); load(o);");
+}
+
+
 THREADED_TEST(Regress137496) {
   i::FLAG_expose_gc = true;
   v8::HandleScope scope;
   LocalContext context;
 
   // Compile a try-finally clause where the finally block causes a GC
   // while there still is a message pending for external reporting.
   TryCatch try_catch;
   try_catch.SetVerbose(true);
   CompileRun("try { throw new Error(); } finally { gc(); }");
   CHECK(try_catch.HasCaught());
 }