Mostly minor comments, let's hear what Erik and Mads say.
http://codereview.chromium.org/1722003/diff/23001/24013 File src/ic.cc (right): http://codereview.chromium.org/1722003/diff/23001/24013#newcode619 src/ic.cc:619: JSFunction::cast(*object)->should_have_prototype()) { why this change? can LoadIC_FunctionPrototype cope with prototype-less functions? http://codereview.chromium.org/1722003/diff/23001/24003 File src/objects.cc (right): http://codereview.chromium.org/1722003/diff/23001/24003#newcode4936 src/objects.cc:4936: ASSERT(map() == context()->global_context()->function_map()); why we're sure map() will always identical to function_map()? Is it possible to invoke this method after we changed somehow function's map (say, assigned a property to it)? http://codereview.chromium.org/1722003/diff/23001/24005 File src/runtime.cc (right): http://codereview.chromium.org/1722003/diff/23001/24005#newcode6558 src/runtime.cc:6558: // case generated code bailouts here, since function has not initial_map. has /no/ initial_map http://codereview.chromium.org/1722003/show -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
