Let ComputeTarget fail if it skips over NORMAL objects.

src/ast.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 491 matching lines @@
 
   if (check_type_ == RECEIVER_MAP_CHECK) {
     // For primitive checks the holder is set up to point to the corresponding
     // prototype object, i.e. one step of the algorithm below has been already
     // performed. For non-primitive checks we clear it to allow computing
     // targets for polymorphic calls.
     holder_ = Handle<JSObject>::null();
   }
   LookupResult lookup(type->GetIsolate());
   while (true) {
+    // If a dictionary map is found in the prototype chain before the actual
+    // target, a new target can always appear. In that case, bail out.
+    // TODO(verwaest): Alternatively a runtime negative lookup on the normal
+    // receiver or prototype could be added.
+    if (type->is_dictionary_map()) return false;
     type->LookupDescriptor(NULL, *name, &lookup);
     if (lookup.IsFound()) {
       switch (lookup.type()) {
         case CONSTANT_FUNCTION:
           // We surely know the target for a constant function.
           target_ =
               Handle<JSFunction>(lookup.GetConstantFunctionFromMap(*type));
           return true;
         case NORMAL:
         case FIELD:
         case CALLBACKS:
         case HANDLER:
         case INTERCEPTOR:
           // We don't know the target.
           return false;
         case TRANSITION:
         case NONEXISTENT:
           UNREACHABLE();
           break;
       }
     }
     // If we reach the end of the prototype chain, we don't know the target.
     if (!type->prototype()->IsJSObject()) return false;
     // Go up the prototype chain, recording where we are currently.
     holder_ = Handle<JSObject>(JSObject::cast(type->prototype()));
-    if (!holder_->HasFastProperties()) return false;
     type = Handle<Map>(holder()->map());
   }
 }
 
 
 bool Call::ComputeGlobalTarget(Handle<GlobalObject> global,
                                LookupResult* lookup) {
   target_ = Handle<JSFunction>::null();
   cell_ = Handle<JSGlobalPropertyCell>::null();
   ASSERT(lookup->IsFound() &&
@@ skipping 562 matching lines @@
     OS::SNPrintF(buffer, "%d", Smi::cast(*handle_)->value());
     str = arr;
   } else {
     str = DoubleToCString(handle_->Number(), buffer);
   }
   return FACTORY->NewStringFromAscii(CStrVector(str));
 }
 
 
 } }  // namespace v8::internal