Always store stubs on the JSObject receiver, even when in slow mode.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index d31070886ebf0671fe9ac60ce3ed24264abbd51c..e7a8eaa8491f2a17cdcbced3a294e7a2def2d956 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -192,15 +192,18 @@ bool IC::TryRemoveInvalidPrototypeDependentStub(Object* receiver,
   InlineCacheHolderFlag cache_holder =
       Code::ExtractCacheHolderFromFlags(target()->flags());
 
-  if (cache_holder == OWN_MAP && !receiver->IsJSObject()) {
-    // The stub was generated for JSObject but called for non-JSObject.
-    // IC::GetCodeCacheHolder is not applicable.
-    return false;
-  } else if (cache_holder == PROTOTYPE_MAP &&
-             receiver->GetPrototype(isolate())->IsNull()) {
-    // IC::GetCodeCacheHolder is not applicable.
-    return false;
+  switch (cache_holder) {
+    case OWN_MAP:
+      // The stub was generated for JSObject but called for non-JSObject.
+      // IC::GetCodeCacheHolder is not applicable.
+      if (!receiver->IsJSObject()) return false;
+      break;
+    case PROTOTYPE_MAP:
+      // IC::GetCodeCacheHolder is not applicable.
+      if (receiver->GetPrototype(isolate())->IsNull()) return false;
+      break;
   }
+
   Map* map = IC::GetCodeCacheHolder(isolate(), receiver, cache_holder)->map();
 
   // Decide whether the inline cache failed because of changes to the
@@ -451,6 +454,11 @@ static bool HasInterceptorGetter(JSObject* object) {
 }
 
 
+static bool HasInterceptorSetter(JSObject* object) {
+  return !object->GetNamedInterceptor()->setter()->IsUndefined();
+}
+
+
 static void LookupForRead(Handle<Object> object,
                           Handle<String> name,
                           LookupResult* lookup) {
@@ -1469,8 +1477,7 @@ static bool LookupForWrite(Handle<JSObject> receiver,
     if (lookup->IsReadOnly() || !lookup->IsCacheable()) return false;
 
     if (lookup->holder() == *receiver) {
-      if (lookup->IsInterceptor() &&
-          receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
+      if (lookup->IsInterceptor() && !HasInterceptorSetter(*receiver)) {
         receiver->LocalLookupRealNamedProperty(*name, lookup);
         return lookup->IsFound() &&
             !lookup->IsReadOnly() &&
@@ -1651,7 +1658,7 @@ void StoreIC::UpdateCaches(LookupResult* lookup,
   // These are not cacheable, so we never see such LookupResults here.
   ASSERT(!lookup->IsHandler());
 
-  Handle<Code> code = ComputeStoreMonomorphic(lookup, receiver, name, value);
+  Handle<Code> code = ComputeStoreHandler(lookup, receiver, name, value);
   if (code.is_null()) {
     set_target(*generic_stub());
     return;
@@ -1662,10 +1669,10 @@ void StoreIC::UpdateCaches(LookupResult* lookup,
 }
 
 
-Handle<Code> StoreIC::ComputeStoreMonomorphic(LookupResult* lookup,
-                                              Handle<JSObject> receiver,
-                                              Handle<String> name,
-                                              Handle<Object> value) {
+Handle<Code> StoreIC::ComputeStoreHandler(LookupResult* lookup,
+                                          Handle<JSObject> receiver,
+                                          Handle<String> name,
+                                          Handle<Object> value) {
   Handle<JSObject> holder(lookup->holder());
   switch (lookup->type()) {
     case FIELD:
@@ -1718,7 +1725,7 @@ Handle<Code> StoreIC::ComputeStoreMonomorphic(LookupResult* lookup,
       break;
     }
     case INTERCEPTOR:
-      ASSERT(!receiver->GetNamedInterceptor()->setter()->IsUndefined());
+      ASSERT(HasInterceptorSetter(*receiver));
       return isolate()->stub_cache()->ComputeStoreInterceptor(
           name, receiver, strict_mode());
     case CONSTANT:
@@ -2051,10 +2058,10 @@ MaybeObject* KeyedStoreIC::Store(Handle<Object> object,
 }
 
 
-Handle<Code> KeyedStoreIC::ComputeStoreMonomorphic(LookupResult* lookup,
-                                                   Handle<JSObject> receiver,
-                                                   Handle<String> name,
-                                                   Handle<Object> value) {
+Handle<Code> KeyedStoreIC::ComputeStoreHandler(LookupResult* lookup,
+                                               Handle<JSObject> receiver,
+                                               Handle<String> name,
+                                               Handle<Object> value) {
   // If the property has a non-field type allowing map transitions
   // where there is extra room in the object, we leave the IC in its
   // current state.