Index: src/arm/ic-arm.cc |
diff --git a/src/arm/ic-arm.cc b/src/arm/ic-arm.cc |
index abbac993df0c8e62dfa08eb90521228af256ad87..219d354c7e8d6e31a62cdee99d659867e7aacfe4 100644 |
--- a/src/arm/ic-arm.cc |
+++ b/src/arm/ic-arm.cc |
@@ -1469,11 +1469,10 @@ void StoreIC::GenerateArrayLength(MacroAssembler* masm) { |
// -- lr : return address |
// ----------------------------------- |
// |
- // This accepts as a receiver anything JSObject::SetElementsLength accepts |
- // (currently anything except for external and pixel arrays which means |
- // anything with elements of FixedArray type.), but currently is restricted |
- // to JSArray. |
- // Value must be a number, but only smis are accepted as the most common case. |
+ // This accepts as a receiver anything JSArray::SetElementsLength accepts |
+ // (currently anything except for external arrays which means anything with |
+ // elements of FixedArray type). Value must be a number, but only smis are |
+ // accepted as the most common case. |
Label miss; |
@@ -1495,6 +1494,13 @@ void StoreIC::GenerateArrayLength(MacroAssembler* masm) { |
__ CompareObjectType(scratch, scratch, scratch, FIXED_ARRAY_TYPE); |
__ b(ne, &miss); |
+ // Check that the array has fast properties, otherwise the length |
+ // property might have been redefined. |
+ __ ldr(scratch, FieldMemOperand(receiver, JSArray::kPropertiesOffset)); |
+ __ ldr(scratch, FieldMemOperand(scratch, FixedArray::kMapOffset)); |
+ __ CompareRoot(scratch, Heap::kHashTableMapRootIndex); |
+ __ b(eq, &miss); |
+ |
// Check that value is a smi. |
__ JumpIfNotSmi(value, &miss); |