Optimize typed-array length loading.

R=dslomov@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23484060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -5670,6 +5670,13 @@ class HObjectAccess V8_FINAL {
                 ? Representation::Smi() : Representation::Tagged());
   }
 
+  static HObjectAccess ForTypedArrayLength() {
+    return HObjectAccess(
+        kInobject,
+        JSTypedArray::kLengthOffset,
+        Representation::Tagged());
+  }
+
   static HObjectAccess ForAllocationSiteTransitionInfo() {
     return HObjectAccess(kInobject, AllocationSite::kTransitionInfoOffset);
   }

src/hydrogen.cc

@@ -4630,6 +4630,13 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::CanLoadAsMonomorphic(
     return true;
   }
 
+  if (IsTypedArrayLength()) {
+    for (int i = 1; i < types->length(); ++i) {
+      if (types->at(i)->instance_type() != JS_TYPED_ARRAY_TYPE) return false;
+    }
+    return true;
+  }
+
   for (int i = 1; i < types->length(); ++i) {
     PropertyAccessInfo test_info(isolate(), types->at(i), name_);
     if (!test_info.IsCompatibleForLoad(this)) return false;
@@ -4657,6 +4664,11 @@ HInstruction* HOptimizedGraphBuilder::BuildLoadMonomorphic(
             info->map()->elements_kind()));
   }
 
+  if (info->IsTypedArrayLength()) {
+    return New<HLoadNamedField>(
+        checked_object, HObjectAccess::ForTypedArrayLength());
+  }
+
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));

src/hydrogen.h

@@ -1982,6 +1982,11 @@ class HOptimizedGraphBuilder V8_FINAL
           name_->Equals(isolate()->heap()->length_string());
     }
 
+    bool IsTypedArrayLength() {
+      return map_->instance_type() == JS_TYPED_ARRAY_TYPE &&
+          name_->Equals(isolate()->heap()->length_string());
+    }
+
     bool has_holder() { return !holder_.is_null(); }
 
     LookupResult* lookup() { return &lookup_; }

src/ic.cc

@@ -1349,6 +1349,19 @@ Handle<Code> LoadIC::ComputeLoadHandler(LookupResult* lookup,
       return isolate()->stub_cache()->ComputeLoadNormal(name, receiver);
     case CALLBACKS: {
       Handle<Object> callback(lookup->GetCallbackObject(), isolate());
+      if (name->Equals(isolate()->heap()->length_string())) {
+        if (receiver->IsJSArray()) {
+          PropertyIndex lengthIndex = PropertyIndex::NewHeaderIndex(
+              JSArray::kLengthOffset / kPointerSize);
+          return isolate()->stub_cache()->ComputeLoadField(
+              name, receiver, receiver, lengthIndex, Representation::Tagged());
+        } else if (receiver->IsJSTypedArray()) {
+          PropertyIndex lengthIndex = PropertyIndex::NewHeaderIndex(
+              JSTypedArray::kLengthOffset / kPointerSize);
+          return isolate()->stub_cache()->ComputeLoadField(
+              name, receiver, receiver, lengthIndex, Representation::Tagged());
+        }
+      }
       if (callback->IsExecutableAccessorInfo()) {
         Handle<ExecutableAccessorInfo> info =
             Handle<ExecutableAccessorInfo>::cast(callback);
@@ -1371,12 +1384,6 @@ Handle<Code> LoadIC::ComputeLoadHandler(LookupResult* lookup,
         }
         return isolate()->stub_cache()->ComputeLoadViaGetter(
             name, receiver, holder, function);
-      } else if (receiver->IsJSArray() &&
-                 name->Equals(isolate()->heap()->length_string())) {
-        PropertyIndex lengthIndex = PropertyIndex::NewHeaderIndex(
-            JSArray::kLengthOffset / kPointerSize);
-        return isolate()->stub_cache()->ComputeLoadField(
-            name, receiver, holder, lengthIndex, Representation::Tagged());
       }
       // TODO(dcarney): Handle correctly.
       if (callback->IsDeclaredAccessorInfo()) break;