Revert change to always call builtins for Array functions....

src/ia32/stub-cache-ia32.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 680 matching lines @@
                Label* miss) {
     ASSERT(holder->HasNamedInterceptor());
     ASSERT(!holder->GetNamedInterceptor()->getter()->IsUndefined());
 
     // Check that the receiver isn't a smi.
     __ test(receiver, Immediate(kSmiTagMask));
     __ j(zero, miss, not_taken);
 
     CallOptimization optimization(lookup);
 
-    if (optimization.is_constant_call()) {
+    if (optimization.is_constant_call() &&
+        !Top::CanHaveSpecialFunctions(holder)) {
       CompileCacheable(masm,
                        object,
                        receiver,
                        scratch1,
                        scratch2,
                        holder,
                        lookup,
                        name,
                        optimization,
                        miss);
@@ skipping 613 matching lines @@
         // Check that the maps starting from the prototype haven't changed.
         GenerateLoadGlobalFunctionPrototype(masm(),
                                             Context::BOOLEAN_FUNCTION_INDEX,
                                             eax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
                         ebx, edx, name, &miss);
       }
       break;
     }
 
+    case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
+      CheckPrototypes(JSObject::cast(object), edx, holder,
+                      ebx, eax, name, &miss);
+      // Make sure object->HasFastElements().
+      // Get the elements array of the object.
+      __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
+      // Check that the object is in fast mode (not dictionary).
+      __ cmp(FieldOperand(ebx, HeapObject::kMapOffset),
+             Immediate(Factory::fixed_array_map()));
+      __ j(not_equal, &miss, not_taken);
+      break;
+
     default:
       UNREACHABLE();
   }
 
   if (depth != kInvalidProtoDepth) {
     GenerateFastApiCall(masm(), optimization, argc);
   } else {
     __ InvokeFunction(function, arguments(), JUMP_FUNCTION);
   }
 
@@ skipping 841 matching lines @@
   __ jmp(generic_construct_stub, RelocInfo::CODE_TARGET);
 
   // Return the generated code.
   return GetCode();
 }
 
 
 #undef __
 
 } }  // namespace v8::internal