[runtime] Only support internalized keys in NameDictionaryShape::IsMatch

BUG=

Change-Id: Iaae90ecfc36f05d596291f4755e767ef2799f2b0
Reviewed-on: https://chromium-review.googlesource.com/448221Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43538}

src/objects-inl.h

@@ -7794,10 +7794,9 @@ Handle<Object> NumberDictionaryShape::AsHandle(Isolate* isolate, uint32_t key) {
 
 
 bool NameDictionaryShape::IsMatch(Handle<Name> key, Object* other) {
-  // We know that all entries in a hash table had their hash keys created.
-  // Use that knowledge to have fast failure.
-  if (key->Hash() != Name::cast(other)->Hash()) return false;
-  return key->Equals(Name::cast(other));
+  DCHECK(Name::cast(other)->IsUniqueName());
+  DCHECK(key->IsUniqueName());
+  return *key == other;
 }
 
 

src/runtime/runtime-object.cc

@@ -53,17 +53,18 @@ static MaybeHandle<Object> KeyedGetObjectProperty(Isolate* isolate,
   if (receiver_obj->IsJSObject()) {
     if (!receiver_obj->IsJSGlobalProxy() &&
         !receiver_obj->IsAccessCheckNeeded() && key_obj->IsName()) {
-      DisallowHeapAllocation no_allocation;
       Handle<JSObject> receiver = Handle<JSObject>::cast(receiver_obj);
       Handle<Name> key = Handle<Name>::cast(key_obj);
       // Get to a ThinString's referenced internalized string, but don't
-      // otherwise force internalization. We assume that internalization
-      // (which is a dictionary lookup with a non-internalized key) is
-      // about as expensive as doing the property dictionary lookup with
-      // the non-internalized key directly.
+      // otherwise force internalization.
       if (key->IsThinString()) {
-        key = handle(Handle<ThinString>::cast(key)->actual(), isolate);
+        key_obj = key =
+            handle(Handle<ThinString>::cast(key)->actual(), isolate);
+      } else {
+        key_obj = key = isolate->factory()->InternalizeName(key);
       }
+
+      DisallowHeapAllocation no_allocation;
       if (receiver->IsJSGlobalObject()) {
         // Attempt dictionary lookup.
         GlobalDictionary* dictionary = receiver->global_dictionary();