Restore per-TypedArray-class length accessors as a perf workaround

This patch is a workaround to the performance regression caused by
implementing the ES2015 TypedArray prototype chain: Include a
per-TypedArray-subclass length getter so that the superclass getter does
not become polymorphic. The patch appears to fix a regression in the
Gameboy Octane benchmark.

BUG=chromium:579905
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1624383003

Cr-Commit-Position: refs/heads/master@{#33501}

src/js/typedarray.js

@@ -263,6 +263,14 @@ function NAMEConstructor(arg1, arg2, arg3) {
   }
 }
 
+// TODO(littledan): Remove this performance workaround BUG(chromium:579905)
+function NAME_GetLength() {
+  if (!(%_ClassOf(this) === 'NAME')) {
+    throw MakeTypeError(kIncompatibleMethodReceiver, "NAME.length", this);
+  }
+  return %_TypedArrayGetLength(this);
+}
+
 function NAMESubArray(begin, end) {
   var beginInt = TO_INTEGER(begin);
   if (!IS_UNDEFINED(end)) {
@@ -829,6 +837,9 @@ macro SETUP_TYPED_ARRAY(ARRAY_ID, NAME, ELEMENT_SIZE)
   %AddNamedProperty(GlobalNAME.prototype,
                     "BYTES_PER_ELEMENT", ELEMENT_SIZE,
                     READ_ONLY | DONT_ENUM | DONT_DELETE);
+  // TODO(littledan): Remove this performance workaround BUG(chromium:579905)
+  utils.InstallGetter(GlobalNAME.prototype, "length", NAME_GetLength,
+                      DONT_ENUM | DONT_DELETE);
 endmacro
 
 TYPED_ARRAYS(SETUP_TYPED_ARRAY)

test/mjsunit/es6/typedarray-proto.js

@@ -28,13 +28,17 @@ assertEquals(TypedArrayPrototype.__proto__, Object.prototype);
 let classProperties = new Set([
   "length", "name", "arguments", "caller", "prototype", "BYTES_PER_ELEMENT"
 ]);
-let instanceProperties = new Set(["BYTES_PER_ELEMENT", "constructor", "prototype"]);
+let instanceProperties = new Set([
+  "BYTES_PER_ELEMENT", "constructor", "prototype",
+  // length is also an instance property as a temporary workaround to
+  // BUG(chromium:579905). TODO(littledan): remove the workaround
+  "length"
+]);
 
 function functionProperties(object) {
   return Object.getOwnPropertyNames(object).filter(function(name) {
     return typeof Object.getOwnPropertyDescriptor(object, name).value
-        == "function"
-      && name != 'constructor' && name != 'subarray';
+        == "function" && name != 'constructor';
   });
 }