Invalidate property cells for non-existent properties properly.

R=verwaest@chromium.org
BUG=v8:3914
LOG=N

Review URL: https://codereview.chromium.org/945403008

Cr-Commit-Position: refs/heads/master@{#26822}

src/objects.cc

@@ -15334,8 +15334,15 @@ void GlobalObject::InvalidatePropertyCell(Handle<GlobalObject> global,
     Handle<PropertyCell> new_cell = isolate->factory()->NewPropertyCell(value);
     global->property_dictionary()->ValueAtPut(entry, *new_cell);
 
-    Handle<Object> hole = global->GetIsolate()->factory()->the_hole_value();
-    PropertyCell::SetValueInferType(cell, hole);
+    Handle<Object> hole = isolate->factory()->the_hole_value();
+    if (*hole != *value) {
+      PropertyCell::SetValueInferType(cell, hole);
+    } else {
+      // If property value was the hole, set it to any other value,
+      // to ensure that LoadNonexistent ICs execute a miss.
+      Handle<Object> undefined = isolate->factory()->undefined_value();
+      PropertyCell::SetValueInferType(cell, undefined);
+    }
   }
 }
 

test/cctest/cctest.status

@@ -98,11 +98,6 @@
   # TODO(jochen): Reenable after we removed the CHECK() from the marking queue.
   'test-mark-compact/MarkingDeque': [SKIP],
 
-  # BUG(3914).
-  'test-decls/CrossScriptStaticLookupUndeclared': [SKIP],
-  'test-decls/CrossScriptReferencesHarmony': [SKIP],
-  'test-decls/CrossScriptReferencesHarmonyRegress': [SKIP],
-
   ############################################################################
   # Slow tests.
   'test-api/Threading1': [PASS, ['mode == debug', SLOW]],