Install a generic handler whenever we fail to update the IC.

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 918 matching lines @@
 
   // If we did not find a property, check if we need to throw an exception.
   if (!lookup.IsFound()) {
     if (IsUndeclaredGlobal(object)) {
       return ReferenceError("not_defined", name);
     }
     LOG(isolate(), SuspectReadEvent(*name, *object));
   }
 
   // Update inline cache and stub cache.
-  if (FLAG_use_ic) {
-    if (!object->IsJSObject()) {
-      // TODO(jkummerow): It would be nice to support non-JSObjects in
-      // UpdateCaches, then we wouldn't need to go generic here.
-      set_target(*generic_stub());
-    } else {
-      UpdateCaches(&lookup, state, object, name);
-    }
-  }
+  if (FLAG_use_ic) UpdateCaches(&lookup, state, object, name);
 
   PropertyAttributes attr;
   if (lookup.IsInterceptor() || lookup.IsHandler()) {
     // Get the property.
     Handle<Object> result =
         Object::GetProperty(object, object, &lookup, name, &attr);
     RETURN_IF_EMPTY_HANDLE(isolate(), result);
     // If the property is not present, check if we need to throw an
     // exception.
     if (attr == ABSENT && IsUndeclaredGlobal(object)) {
@@ skipping 239 matching lines @@
       break;
   }
 }
 
 
 void LoadIC::UpdateCaches(LookupResult* lookup,
                           State state,
                           Handle<Object> object,
                           Handle<String> name) {
   // Bail out if the result is not cacheable.
-  if (!lookup->IsCacheable()) return;
+  if (!lookup->IsCacheable()) {
+    set_target(*generic_stub());
+    return;
+  }
 
-  // Loading properties from values is not common, so don't try to
-  // deal with non-JS objects here.
-  if (!object->IsJSObject()) return;
+  // TODO(jkummerow): It would be nice to support non-JSObjects in
+  // UpdateCaches, then we wouldn't need to go generic here.
+  if (!object->IsJSObject()) {
+    set_target(*generic_stub());
+    return;
+  }
 
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
   Handle<Code> code;
   if (state == UNINITIALIZED) {
     // This is the first time we execute this inline cache.
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
     code = pre_monomorphic_stub();
   } else {
     code = ComputeLoadHandler(lookup, receiver, name);
-    if (code.is_null()) return;
+    if (code.is_null()) {
+      set_target(*generic_stub());
+      return;
+    }
   }
 
   PatchCache(state, kNonStrictMode, receiver, name, code);
   TRACE_IC("LoadIC", name, state, target());
 }
 
 
 void IC::UpdateMegamorphicCache(Map* map, Name* name, Code* code) {
   // Cache code holding map should be consistent with
   // GenerateMonomorphicCacheProbe.
@@ skipping 400 matching lines @@
   LookupResult lookup(isolate());
   if (LookupForWrite(receiver, name, value, &lookup, &state)) {
     if (FLAG_use_ic) {
       UpdateCaches(&lookup, state, strict_mode, receiver, name, value);
     }
   } else if (strict_mode == kStrictMode &&
              !(lookup.IsProperty() && lookup.IsReadOnly()) &&
              IsUndeclaredGlobal(object)) {
     // Strict mode doesn't allow setting non-existent global property.
     return ReferenceError("not_defined", name);
+  } else if (FLAG_use_ic &&
+             (lookup.IsNormal() ||
+              (lookup.IsField() && lookup.CanHoldValue(value)))) {
+    Handle<Code> stub = strict_mode == kStrictMode
+        ? generic_stub_strict() : generic_stub();
+    set_target(*stub);
   }
 
   // Set the property.
   return JSReceiver::SetPropertyOrFail(
       receiver, name, value, NONE, strict_mode, store_mode);
 }
 
 
 void StoreIC::UpdateCaches(LookupResult* lookup,
                            State state,
                            StrictModeFlag strict_mode,
                            Handle<JSObject> receiver,
                            Handle<String> name,
                            Handle<Object> value) {
   ASSERT(!receiver->IsJSGlobalProxy());
   ASSERT(lookup->IsFound());
 
   // These are not cacheable, so we never see such LookupResults here.
   ASSERT(!lookup->IsHandler());
 
-  Handle<Code> code =
-      ComputeStoreMonomorphic(lookup, strict_mode, receiver, name);
-  if (code.is_null()) return;
+  Handle<Code> code = ComputeStoreMonomorphic(
+      lookup, strict_mode, receiver, name);
+  if (code.is_null()) {
+    Handle<Code> stub = strict_mode == kStrictMode
+        ? generic_stub_strict() : generic_stub();
+    set_target(*stub);
+    return;
+  }
 
   PatchCache(state, strict_mode, receiver, name, code);
   TRACE_IC("StoreIC", name, state, target());
 }
 
 
 Handle<Code> StoreIC::ComputeStoreMonomorphic(LookupResult* lookup,
                                               StrictModeFlag strict_mode,
                                               Handle<JSObject> receiver,
                                               Handle<String> name) {
@@ skipping 1376 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal