Replace ICStub for array.length with hydrogen stub

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index bbcdd3b7b90a76ac01728da4a5782524cd902878..52d74baee7bcd59d685ec960f7aa0194c2ec4b2d 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1050,6 +1050,11 @@ HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
                                 elements_kind, is_store);
 }
 
+HInstruction* HGraphBuilder::BuildFastArrayLengthLoad(HValue* object) {
+  Zone* zone = this->zone();
+  return new (zone) HJSArrayLength(object, NULL, HType::Smi());
+}
+
 
 HValue* HGraphBuilder::BuildAllocateElements(HContext* context,
                                              ElementsKind kind,
@@ -6734,6 +6739,15 @@ HInstruction* HOptimizedGraphBuilder::BuildLoadNamedMonomorphic(
     Handle<Map> map) {
   // Handle a load from a known field.
   ASSERT(!map->is_dictionary_map());
+
+  // Handle access to various length properties
+  if (name->Equals(isolate()->heap()->length_string())) {
+    if (map->instance_type() == JS_ARRAY_TYPE) {
+      AddCheckMapsWithTransitions(object, map);
+      return BuildFastArrayLengthLoad(object);
+    }
+  }
+

[Dmitry Lomov (no reviews), 2013/03/11 17:31:31]

Not sure if this is the best place yet to do this; the better way will be to do
the check in the polymorphic case and generate length load if all the maps are
array maps

[danno, 2013/03/12 11:16:16]

Those are two separate issues. For monomorphic handling, this is not a bad
place. For polymorphic handling, you will have to change
HandlePolymorphicLoadNamedField as you describe.

On 2013/03/11 17:31:31, Dmitry Lomov (chromium) wrote:

   LookupResult lookup(isolate());
   map->LookupDescriptor(NULL, *name, &lookup);
   if (lookup.IsField()) {