Reverting r4703.

src/ia32/stub-cache-ia32.cc

Index: src/ia32/stub-cache-ia32.cc
===================================================================
--- src/ia32/stub-cache-ia32.cc	(revision 4703)
+++ src/ia32/stub-cache-ia32.cc	(working copy)
@@ -1173,7 +1173,7 @@
     __ j(not_equal, &miss);
 
     if (argc == 1) {  // Otherwise fall through to call builtin.
-      Label call_builtin, exit, with_write_barrier, attempt_to_grow_elements;
+      Label call_builtin, exit, with_rset_update, attempt_to_grow_elements;
 
       // Get the array's length into eax and calculate new length.
       __ mov(eax, FieldOperand(edx, JSArray::kLengthOffset));
@@ -1183,6 +1183,7 @@
 
       // Get the element's length into ecx.
       __ mov(ecx, FieldOperand(ebx, FixedArray::kLengthOffset));
+      __ SmiTag(ecx);
 
       // Check if we could survive without allocation.
       __ cmp(eax, Operand(ecx));
@@ -1200,16 +1201,17 @@
 
       // Check if value is a smi.
       __ test(ecx, Immediate(kSmiTagMask));
-      __ j(not_zero, &with_write_barrier);
+      __ j(not_zero, &with_rset_update);
 
       __ bind(&exit);
       __ ret((argc + 1) * kPointerSize);
 
-      __ bind(&with_write_barrier);
+      __ bind(&with_rset_update);
 
       __ InNewSpace(ebx, ecx, equal, &exit);
 
-      __ RecordWriteHelper(ebx, edx, ecx);
+      RecordWriteStub stub(ebx, edx, ecx);
+      __ CallStub(&stub);
       __ ret((argc + 1) * kPointerSize);
 
       __ bind(&attempt_to_grow_elements);
@@ -1249,10 +1251,10 @@
 
       // Increment element's and array's sizes.
       __ add(FieldOperand(ebx, FixedArray::kLengthOffset),
-             Immediate(Smi::FromInt(kAllocationDelta)));
+             Immediate(kAllocationDelta));
       __ mov(FieldOperand(edx, JSArray::kLengthOffset), eax);
 
-      // Elements are in new space, so write barrier is not required.
+      // Elements are in new space, so no remembered set updates are necessary.
       __ ret((argc + 1) * kPointerSize);
 
       __ bind(&call_builtin);