Version 4.9.385.14 (cherry-pick)

src/js/typedarray.js

Index: src/js/typedarray.js
diff --git a/src/js/typedarray.js b/src/js/typedarray.js
index b3e1c829dd62b9926a3c335f952a20a233dc22db..fd668a57fddceb2222d31d91ccad806dc5395bc8 100644
--- a/src/js/typedarray.js
+++ b/src/js/typedarray.js
@@ -263,6 +263,14 @@ function NAMEConstructor(arg1, arg2, arg3) {
   }
 }
 
+// TODO(littledan): Remove this performance workaround BUG(chromium:579905)
+function NAME_GetLength() {
+  if (!(%_ClassOf(this) === 'NAME')) {
+    throw MakeTypeError(kIncompatibleMethodReceiver, "NAME.length", this);
+  }
+  return %_TypedArrayGetLength(this);
+}
+
 function NAMESubArray(begin, end) {
   var beginInt = TO_INTEGER(begin);
   if (!IS_UNDEFINED(end)) {
@@ -829,6 +837,9 @@ macro SETUP_TYPED_ARRAY(ARRAY_ID, NAME, ELEMENT_SIZE)
   %AddNamedProperty(GlobalNAME.prototype,
                     "BYTES_PER_ELEMENT", ELEMENT_SIZE,
                     READ_ONLY | DONT_ENUM | DONT_DELETE);
+  // TODO(littledan): Remove this performance workaround BUG(chromium:579905)
+  utils.InstallGetter(GlobalNAME.prototype, "length", NAME_GetLength,
+                      DONT_ENUM | DONT_DELETE);
 endmacro
 
 TYPED_ARRAYS(SETUP_TYPED_ARRAY)