Reland Handle non-JSObject heap objects using slow-path IC stub guarded by the map.

Reland Handle non-JSObject heap objects using slow-path IC stub guarded by the map.

R=mstarzinger@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=16696

[Toon Verwaest, 2013-09-12 17:59:50]

PTAL

[Michael Starzinger, 2013-09-12 21:41:38]

LGTM (only reviewed delta between first and second patch set).

https://codereview.chromium.org/23578030/diff/3001/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/23578030/diff/3001/src/hydrogen.cc#newcode4625
src/hydrogen.cc:4625: ASSERT(holder_map->IsJSObjectMap());
This is virtually guaranteed, as we are loading the map out of a JSObject,
please drop it.

https://codereview.chromium.org/23578030/diff/3001/src/hydrogen.cc#newcode5413
src/hydrogen.cc:5413: ASSERT(holder_map->IsJSObjectMap());
Likewise.

[Toon Verwaest, 2013-09-12 22:03:39]

Addressed comments. Landing.

[Toon Verwaest, 2013-09-12 22:04:17]

Committed patchset #3 manually as r16696 (presubmit successful).