Replace ICStub for array.length with hydrogen stub

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1032 matching lines @@
                                                      HType::Smi()));
   } else {
     length = AddInstruction(new(zone) HFixedArrayBaseLength(elements));
   }
   checked_key = AddBoundsCheck(
       key, length, ALLOW_SMI_KEY, checked_index_representation);
   return BuildFastElementAccess(elements, checked_key, val, mapcheck,
                                 elements_kind, is_store);
 }
 
+HInstruction* HGraphBuilder::BuildFastArrayLengthLoad(HValue* object) {
+  Zone* zone = this->zone();
+  return new (zone) HJSArrayLength(object, NULL, HType::Smi());
+}
+
 
 HValue* HGraphBuilder::BuildAllocateElements(HContext* context,
                                              ElementsKind kind,
                                              HValue* capacity) {
   Zone* zone = this->zone();
 
   int elements_size = IsFastDoubleElementsKind(kind)
       ? kDoubleSize : kPointerSize;
   HConstant* elements_size_value =
       new(zone) HConstant(elements_size, Representation::Integer32());
@@ skipping 5664 matching lines @@
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedMonomorphic(
     HValue* object,
     Handle<String> name,
     Property* expr,
     Handle<Map> map) {
   // Handle a load from a known field.
   ASSERT(!map->is_dictionary_map());
+
+  // Handle access to various length properties
+  if (name->Equals(isolate()->heap()->length_string())) {
+    if (map->instance_type() == JS_ARRAY_TYPE) {
+      AddCheckMapsWithTransitions(object, map);
+      return BuildFastArrayLengthLoad(object);
+    }
+  }
+

[Dmitry Lomov (no reviews), 2013/03/11 17:31:31]

Not sure if this is the best place yet to do this; the better way will be to do
the check in the polymorphic case and generate length load if all the maps are
array maps

[danno, 2013/03/12 11:16:16]

Those are two separate issues. For monomorphic handling, this is not a bad
place. For polymorphic handling, you will have to change
HandlePolymorphicLoadNamedField as you describe.

On 2013/03/11 17:31:31, Dmitry Lomov (chromium) wrote:

   LookupResult lookup(isolate());
   map->LookupDescriptor(NULL, *name, &lookup);
   if (lookup.IsField()) {
     AddCheckMapsWithTransitions(object, map);
     return BuildLoadNamedField(object, map, &lookup);
   }
 
   // Handle a load of a constant known function.
   if (lookup.IsConstantFunction()) {
     AddCheckMapsWithTransitions(object, map);
@@ skipping 4129 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal