From 8eb704257fdea73f4d9e6d4fa1d09e4649965bac Mon Sep 17 00:00:00 2001
From: "rossberg@chromium.org"
 <rossberg@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 8 Nov 2012 13:15:54 +0000
Subject: [PATCH] Object.observe: Fixed missing case for turning off ICs.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358122

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/ic.cc                              |  6 ++++--
 src/objects.cc                         |  2 +-
 test/mjsunit/harmony/object-observe.js | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/src/ic.cc b/src/ic.cc
index 50a3a27..5cc213f 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1920,8 +1920,10 @@ MaybeObject* KeyedStoreIC::Store(State state,
   }
 
   // Do not use ICs for objects that require access checks (including
-  // the global object).
-  bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded();
+  // the global object), or are observed.
+  bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded() &&
+      !(FLAG_harmony_observation && object->IsJSObject() &&
+          JSObject::cast(*object)->map()->is_observed());
   ASSERT(!(use_ic && object->IsJSGlobalProxy()));
 
   if (use_ic) {
diff --git a/src/objects.cc b/src/objects.cc
index a310685..2319932 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -10292,7 +10292,7 @@ MaybeObject* JSObject::SetElement(uint32_t index,
   // From here on, everything has to be handlified.
   Handle<String> name;
   Handle<Object> old_value(isolate->heap()->the_hole_value());
-  PropertyAttributes old_attributes;
+  PropertyAttributes old_attributes = ABSENT;
   bool preexists = false;
   if (FLAG_harmony_observation && map()->is_observed()) {
     name = isolate->factory()->Uint32ToString(index);
diff --git a/test/mjsunit/harmony/object-observe.js b/test/mjsunit/harmony/object-observe.js
index 27cf2f9..4f06842 100644
--- a/test/mjsunit/harmony/object-observe.js
+++ b/test/mjsunit/harmony/object-observe.js
@@ -332,3 +332,35 @@ observer.assertCallbackRecords([
   { object: obj, name: "1", type: "deleted", oldValue: 10 },
   { object: obj, name: "1", type: "new" },
 ]);
+
+
+// Assignments in loops (checking different IC states).
+reset();
+var obj = {};
+Object.observe(obj, observer.callback);
+for (var i = 0; i < 5; i++) {
+  obj["a" + i] = i;
+}
+Object.deliverChangeRecords(observer.callback);
+observer.assertCallbackRecords([
+  { object: obj, name: "a0", type: "new" },
+  { object: obj, name: "a1", type: "new" },
+  { object: obj, name: "a2", type: "new" },
+  { object: obj, name: "a3", type: "new" },
+  { object: obj, name: "a4", type: "new" },
+]);
+
+reset();
+var obj = {};
+Object.observe(obj, observer.callback);
+for (var i = 0; i < 5; i++) {
+  obj[i] = i;
+}
+Object.deliverChangeRecords(observer.callback);
+observer.assertCallbackRecords([
+  { object: obj, name: "0", type: "new" },
+  { object: obj, name: "1", type: "new" },
+  { object: obj, name: "2", type: "new" },
+  { object: obj, name: "3", type: "new" },
+  { object: obj, name: "4", type: "new" },
+]);
-- 
2.7.4