From fb306f98110dbaf65d7504ef5d3c20e07fcebfd5 Mon Sep 17 00:00:00 2001
From: "verwaest@chromium.org"
 <verwaest@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Tue, 4 Feb 2014 22:46:53 +0000
Subject: [PATCH] Explicitly disallow stores to JSObjectAccessors (for now).
 TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/154873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/hydrogen.cc | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 8185596..1593301 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5442,12 +5442,7 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
   if (!CanInlinePropertyAccess(type_)) return false;
-  if (IsJSObjectFieldAccessor()) {
-    // We should never have gathered typefeedback for JSObjectFieldAccessor
-    // stores.
-    ASSERT(IsLoad());
-    return true;
-  }
+  if (IsJSObjectFieldAccessor()) return IsLoad();
   if (!LookupDescriptor()) return false;
   if (lookup_.IsFound()) {
     if (IsLoad()) return true;
-- 
2.7.4