diff --git a/src/compiler/js-heap-broker.cc b/src/compiler/js-heap-broker.cc index 9b7645e31b..0825c387b6 100644 --- a/src/compiler/js-heap-broker.cc +++ b/src/compiler/js-heap-broker.cc @@ -4689,11 +4689,22 @@ void FilterRelevantReceiverMaps(Isolate* isolate, MapHandles* maps) { } MaybeObjectHandle TryGetMinimorphicHandler( - std::vector const& maps_and_handlers, - FeedbackSlotKind kind) { + std::vector const& maps_and_handlers, FeedbackSlotKind kind, + Handle native_context) { if (!FLAG_dynamic_map_checks || !IsLoadICKind(kind)) return MaybeObjectHandle(); + // Don't use dynamic map checks when loading properties from Array.prototype. + // Using dynamic map checks prevents constant folding and hence does not + // inline the array builtins. We only care about monomorphic cases here. For + // polymorphic loads currently we don't inline the builtins even without + // dynamic map checks. + if (maps_and_handlers.size() == 1 && + *maps_and_handlers[0].first == + native_context->initial_array_prototype().map()) { + return MaybeObjectHandle(); + } + MaybeObjectHandle initial_handler; for (MapAndHandler map_and_handler : maps_and_handlers) { auto map = map_and_handler.first; @@ -4751,7 +4762,8 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess( base::Optional name = static_name.has_value() ? static_name : GetNameFeedback(nexus); - MaybeObjectHandle handler = TryGetMinimorphicHandler(maps_and_handlers, kind); + MaybeObjectHandle handler = TryGetMinimorphicHandler( + maps_and_handlers, kind, target_native_context().object()); if (!handler.is_null()) { MaybeHandle maybe_map; if (nexus.ic_state() == MONOMORPHIC) {