Fix invalid usage of StoreIC_ArrayLength optimization.

Fix invalid usage of StoreIC_ArrayLength optimization.

This introduces an additional check into the StoreIC_ArrayLength builtin
checking that the array still has fast properties. Redifinitions of the
length property that would cause it's type or attributes to change, will
switch to slow properties, thereby invalidating said optimization.

R=svenpanne@chromium.org
BUG=v8:1756
TEST=test262

Committed: http://code.google.com/p/v8/source/detail?r=10254

[Michael Starzinger, 2011-12-13 15:33:33]

PTAL.

[Sven Panne, 2011-12-14 09:48:12]

http://codereview.chromium.org/8895025/diff/2001/src/ia32/ic-ia32.cc
File src/ia32/ic-ia32.cc (right):

http://codereview.chromium.org/8895025/diff/2001/src/ia32/ic-ia32.cc#newcode1406
src/ia32/ic-ia32.cc:1406: __ cmp(FieldOperand(scratch, FixedArray::kMapOffset),
Immediate(map));
Perhaps we should generalize CompareRoot a bit (like on x64) and use it here?

http://codereview.chromium.org/8895025/diff/2001/src/x64/ic-x64.cc
File src/x64/ic-x64.cc (right):

http://codereview.chromium.org/8895025/diff/2001/src/x64/ic-x64.cc#newcode1429
src/x64/ic-x64.cc:1429: __ Cmp(FieldOperand(scratch, FixedArray::kMapOffset),
map);
We can probably use CompareRoot here.

[Michael Starzinger, 2011-12-14 10:10:15]

Also changed ARM to use CompareRoot() instead.

http://codereview.chromium.org/8895025/diff/2001/src/ia32/ic-ia32.cc
File src/ia32/ic-ia32.cc (right):

http://codereview.chromium.org/8895025/diff/2001/src/ia32/ic-ia32.cc#newcode1406
src/ia32/ic-ia32.cc:1406: __ cmp(FieldOperand(scratch, FixedArray::kMapOffset),
Immediate(map));
On 2011/12/14 09:48:12, Sven wrote:
> Perhaps we should generalize CompareRoot a bit (like on x64) and use it here?

Done.

http://codereview.chromium.org/8895025/diff/2001/src/x64/ic-x64.cc
File src/x64/ic-x64.cc (right):

http://codereview.chromium.org/8895025/diff/2001/src/x64/ic-x64.cc#newcode1429
src/x64/ic-x64.cc:1429: __ Cmp(FieldOperand(scratch, FixedArray::kMapOffset),
map);
On 2011/12/14 09:48:12, Sven wrote:
> We can probably use CompareRoot here.

Done.

[Sven Panne, 2011-12-14 10:29:02]

lgtm