commit 38b489186b713900b54c4777a4a30a063cec9aea
author Benedikt Meurer <bmeurer@chromium.org> Mon Oct 02 19:01:28 2017
committer Commit Bot <commit-bot@chromium.org> Tue Oct 03 06:30:41 2017
tree 95e569730b7c21b45e0a0dd912f06d68e176c808
parent 0c93ef357d7e0e969322fe0378463203af9358a4

[ic] Transition to MEGAMORPHIC when (map, handler) stays the same.

THe change in https://chromium-review.googlesource.com/695108 flushed
out an issue with the IC::UpdatePolymorphicIC logic, where we'd try to
stay MONOMORPHIC or POLYMORPHIC as long as the internalized name doesn't
change. But the calling code already does the internalization for keyed
accesses with Strings, so we need to double check that the same
combination of (map, handler) is not already in the list, and properly
go to MEGAMORPHIC state if there's such a pair already.

This seriously tanked the six-speed-object-literals-ext-es5.js benchmark
on AWFY.

Bug: v8:6367, v8:6278, v8:6344
Change-Id: I90ea88d1fe61c165990c0a10d4a8687ffe351986
Reviewed-on: https://chromium-review.googlesource.com/695307
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48268}