Explicitly disallow stores to JSObjectAccessors (for now).

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/154873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 8185596..1593301 100644 (file)
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5442,12 +5442,7 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
   if (!CanInlinePropertyAccess(type_)) return false;
-  if (IsJSObjectFieldAccessor()) {
-    // We should never have gathered typefeedback for JSObjectFieldAccessor
-    // stores.
-    ASSERT(IsLoad());
-    return true;
-  }
+  if (IsJSObjectFieldAccessor()) return IsLoad();
   if (!LookupDescriptor()) return false;
   if (lookup_.IsFound()) {
     if (IsLoad()) return true;