Revert r13025 and r13026 (they introduced a bug on arm and regressed octane crypto).

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 6573 matching lines @@
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
   expr->RecordTypeFeedback(oracle(), zone());
 
   if (TryArgumentsAccess(expr)) return;
 
   CHECK_ALIVE(VisitForValue(expr->obj()));
 
   HInstruction* instr = NULL;
   if (expr->AsProperty()->IsArrayLength()) {
-    // Note that in the monomorphic case IsArrayLength() is false because we
-    // handle that it with a regular property load IC.
     HValue* array = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(array));
     HInstruction* mapcheck =
         AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
     instr = new(zone()) HJSArrayLength(array, mapcheck);
   } else if (expr->IsStringLength()) {
     HValue* string = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(string));
     AddInstruction(HCheckInstanceType::NewIsString(string, zone()));
     instr = new(zone()) HStringLength(string);
@@ skipping 15 matching lines @@
   } else if (expr->key()->IsPropertyName()) {
     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
     SmallMapList* types = expr->GetReceiverTypes();
 
     bool monomorphic = expr->IsMonomorphic();
     Handle<Map> map;
     if (expr->IsMonomorphic()) {
       map = types->first();
       if (map->is_dictionary_map()) monomorphic = false;
     }
-
-    // Try to see if this is an array length access.
-    if (name->Equals(isolate()->heap()->length_symbol())) {
-      bool is_array = false;
-      bool fast_mode = false;
-      bool map_mode = false;
-      HInstruction* mapcheck = NULL;
-
-      if (expr->IsMonomorphic()) {
-        // Even if there is more than one map they all must be element
-        // transition maps, so checking just one is ok.
-        if (map->instance_type() == JS_ARRAY_TYPE) {
-          is_array = true;
-          map_mode = true;
-          fast_mode = IsFastElementsKind(map->elements_kind());
-        }
+    if (monomorphic) {
+      Handle<JSFunction> getter;
+      Handle<JSObject> holder;
+      if (LookupGetter(map, name, &getter, &holder)) {
+        AddCheckConstantFunction(holder, Top(), map);
+        if (FLAG_inline_accessors && TryInlineGetter(getter, expr)) return;
+        AddInstruction(new(zone()) HPushArgument(Pop()));
+        instr = new(zone()) HCallConstantFunction(getter, 1);
       } else {
-        // Since we will emit an instance check we have to conservatively
-        // assume that some arrays will contain slow elements, so we set
-        // fast_mode to false.
-        map_mode = false;
-        fast_mode = false;
-        is_array = true;
-        for (int i = 0; i < types->length(); i++) {
-          Handle<Map> current_map = types->at(i);
-          if (current_map->instance_type() != JS_ARRAY_TYPE) {
-            is_array = false;
-            break;
-          }
-        }
+        instr = BuildLoadNamedMonomorphic(Pop(), name, expr, map);
       }
-
-      // It is an array length access so we produce a HJSArrayLength.
-      if (is_array) {
-        HValue* array = Pop();
-        AddInstruction(new(zone()) HCheckNonSmi(array));
-        mapcheck = map_mode ?
-            HInstruction::cast(
-                new(zone()) HCheckMaps(array, map, zone(), NULL,
-                                       ALLOW_ELEMENT_TRANSITION_MAPS)) :
-            HInstruction::cast(
-                HCheckInstanceType::NewIsJSArray(array, zone()));
-        AddInstruction(mapcheck);
-        instr = new(zone()) HJSArrayLength(
-            array, mapcheck, fast_mode ? HType::Smi() : HType::Tagged());
-      }
+    } else if (types != NULL && types->length() > 1) {
+      return HandlePolymorphicLoadNamedField(expr, Pop(), types, name);
+    } else {
+      instr = BuildLoadNamedGeneric(Pop(), name, expr);
     }
 
-    // We cannot know if it was an array length access so we handle it as
-    // a regular property access.
-    if (instr == NULL) {
-      if (monomorphic) {
-        Handle<JSFunction> getter;
-        Handle<JSObject> holder;
-        if (LookupGetter(map, name, &getter, &holder)) {
-          AddCheckConstantFunction(holder, Top(), map);
-          if (FLAG_inline_accessors && TryInlineGetter(getter, expr)) return;
-          AddInstruction(new(zone()) HPushArgument(Pop()));
-          instr = new(zone()) HCallConstantFunction(getter, 1);
-        } else {
-          instr = BuildLoadNamedMonomorphic(Pop(), name, expr, map);
-        }
-      } else if (types != NULL && types->length() > 1) {
-        return HandlePolymorphicLoadNamedField(expr, Pop(), types, name);
-      } else {
-        instr = BuildLoadNamedGeneric(Pop(), name, expr);
-      }
-    }
   } else {
     CHECK_ALIVE(VisitForValue(expr->key()));
 
     HValue* key = Pop();
     HValue* obj = Pop();
 
     bool has_side_effects = false;
     HValue* load = HandleKeyedElementAccess(
         obj, key, NULL, expr, expr->id(), expr->position(),
         false,  // is_store
@@ skipping 3397 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal