Always store stubs on the JSObject receiver, even when in slow mode.

src/stub-cache.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 76 matching lines @@
                       Code::ExtraICState extra_state = Code::kNoExtraICState);
 
   Handle<Code> FindIC(Handle<Name> name,
                       Handle<JSObject> stub_holder,
                       Code::Kind kind,
                       Code::StubType type,
                       Code::ExtraICState extra_state = Code::kNoExtraICState);
 
   Handle<Code> FindLoadHandler(Handle<Name> name,
                                Handle<JSObject> receiver,
-                               Handle<JSObject> stub_holder,
                                Code::Kind kind,
                                Code::StubType type);
 
   Handle<Code> FindStoreHandler(Handle<Name> name,
                                 Handle<JSObject> receiver,
                                 Code::Kind kind,
                                 Code::StubType type,
                                 StrictModeFlag strict_mode);
 
   Handle<Code> ComputeMonomorphicIC(Handle<HeapObject> receiver,
@@ skipping 932 matching lines @@
 #define SITE_SPECIFIC_CALL_GENERATORS(V)        \
   V(ArrayCode)
 
 
 class CallStubCompiler: public StubCompiler {
  public:
   CallStubCompiler(Isolate* isolate,
                    int argc,
                    Code::Kind kind,
                    Code::ExtraICState extra_state,
-                   InlineCacheHolderFlag cache_holder);
+                   InlineCacheHolderFlag cache_holder = OWN_MAP);
 
   Handle<Code> CompileCallField(Handle<JSObject> object,
                                 Handle<JSObject> holder,
                                 PropertyIndex index,
                                 Handle<Name> name);
 
   void CompileHandlerFrontend(Handle<Object> object,
                               Handle<JSObject> holder,
                               Handle<Name> name,
                               CheckType check,
@@ skipping 127 matching lines @@
   Handle<JSFunction> constant_function_;
   bool is_simple_api_call_;
   Handle<FunctionTemplateInfo> expected_receiver_type_;
   Handle<CallHandlerInfo> api_call_info_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_STUB_CACHE_H_