Fix invalid usage of StoreIC_ArrayLength optimization.

src/ia32/ic-ia32.cc

Index: src/ia32/ic-ia32.cc
diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc
index a83db129a1db4532a7825cd9e051759bf5a00b8c..387dd87879b3f167e5cf191dcb0bbf116e49ec32 100644
--- a/src/ia32/ic-ia32.cc
+++ b/src/ia32/ic-ia32.cc
@@ -1374,10 +1374,10 @@ void StoreIC::GenerateArrayLength(MacroAssembler* masm) {
   //  -- esp[0] : return address
   // -----------------------------------
   //
-  // This accepts as a receiver anything JSObject::SetElementsLength accepts
+  // This accepts as a receiver anything JSArray::SetElementsLength accepts
   // (currently anything except for external arrays which means anything with
-  // elements of FixedArray type.), but currently is restricted to JSArray.
-  // Value must be a number, but only smis are accepted as the most common case.
+  // elements of FixedArray type).  Value must be a number, but only smis are
+  // accepted as the most common case.
 
   Label miss;
 
@@ -1399,6 +1399,13 @@ void StoreIC::GenerateArrayLength(MacroAssembler* masm) {
   __ CmpObjectType(scratch, FIXED_ARRAY_TYPE, scratch);
   __ j(not_equal, &miss);
 
+  // Check that the array has fast properties, otherwise the length
+  // property might have been redefined.
+  Handle<Map> map = masm->isolate()->factory()->hash_table_map();
+  __ mov(scratch, FieldOperand(receiver, JSArray::kPropertiesOffset));
+  __ cmp(FieldOperand(scratch, FixedArray::kMapOffset), Immediate(map));

[Sven Panne, 2011/12/14 09:48:12]

Perhaps we should generalize CompareRoot a bit (like on x64) and use it here?

[Michael Starzinger, 2011/12/14 10:10:15]

Done.

+  __ j(equal, &miss);
+
   // Check that value is a smi.
   __ JumpIfNotSmi(value, &miss);