[ic] Properly handle the case when all receiver maps are deprecated.

This may happen in KeyedStoreIC when the last store via setter deprecates the receiver map.

Bug: chromium:723366
Change-Id: Iff19e50c3761584401340d276ab4eead111883c3
Reviewed-on: https://chromium-review.googlesource.com/517952Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45592}

src/ic/ic.cc

@@ -2032,8 +2032,9 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
 
   List<Handle<Object>> handlers(static_cast<int>(target_receiver_maps.size()));
   StoreElementPolymorphicHandlers(&target_receiver_maps, &handlers, store_mode);
-  DCHECK_LE(1, target_receiver_maps.size());
-  if (target_receiver_maps.size() == 1) {
+  if (target_receiver_maps.size() == 0) {
+    ConfigureVectorState(PREMONOMORPHIC, Handle<Name>());
+  } else if (target_receiver_maps.size() == 1) {
     ConfigureVectorState(Handle<Name>(), target_receiver_maps[0],
                          handlers.at(0));
   } else {

test/mjsunit/regress/regress-723366.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {foo: 0, 0: 0, 2: 2, 3: 3};
+o.__defineSetter__("1", function(v) { this.foo = 0.1; });
+
+for(var i = 0; i < 4; i++) {
+  switch (i) {
+    case 0: o.p1 = 0; break;
+    case 1: o.p2 = 0; break;
+  }
+  o[i] = i;
+}