[ic] Use slow stub element handler for non-JSObjects

syg · V8 LUCI CQ · commit 8a69c7880844 · 2024-05-13T08:38:10.000Z
Fixed: 339736513 Change-Id: I134a046475b0b004c3de1bacc5b2f1a7fa503d96 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5527898 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#93847}
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
@@ -2388,15 +2388,16 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
               isolate()),
       IsStoreInArrayLiteralIC());
 
-  if (IsJSProxyMap(*receiver_map)) {
+  if (!IsJSObjectMap(*receiver_map)) {
     // DefineKeyedOwnIC, which is used to define computed fields in instances,
-    // should be handled by the slow stub.
-    if (IsDefineKeyedOwnIC()) {
-      TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
-      return StoreHandler::StoreSlow(isolate(), store_mode);
+    // should handled by the slow stub below instead of the proxy stub.
+    if (IsJSProxyMap(*receiver_map) && !IsDefineKeyedOwnIC()) {
+      return StoreHandler::StoreProxy(isolate());
     }
 
-    return StoreHandler::StoreProxy(isolate());
+    // Wasm objects or other kind of special objects go through the slow stub.
+    TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
+    return StoreHandler::StoreSlow(isolate(), store_mode);
   }
 
   // TODO(ishell): move to StoreHandler::StoreElement().
