[cleanup] Reuse length in AccessorAssembler::HandlePolymorphicCase().

When the length is already available from an unrolled iteration (which
seems to be the common case), we can just reuse that below for the
actual loop. Also it's probably cheaper to always use IntPtr instead of
Smi for the length, since that way we don't need expensive SmiConstant
for the abort conditions in the unrolled iterations.

Change-Id: I322c5d864d58bc56c181473ca8b796a7ab27a51f
Reviewed-on: https://chromium-review.googlesource.com/c/1445984Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59211}

src/ic/accessor-assembler.cc

@@ -124,8 +124,10 @@ void AccessorAssembler::HandlePolymorphicCase(
     int handler_index = i * kEntrySize + 1;
 
     if (i >= min_feedback_capacity) {
-      if (length == nullptr) length = LoadWeakFixedArrayLength(feedback);
-      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), CAST(length)),
+      if (length == nullptr) {
+        length = LoadAndUntagWeakFixedArrayLength(feedback);
+      }
+      GotoIf(IntPtrGreaterThanOrEqual(IntPtrConstant(handler_index), length),
              if_miss);
     }
 
@@ -149,7 +151,8 @@ void AccessorAssembler::HandlePolymorphicCase(
   // Loop from {kUnrolledIterations}*kEntrySize to {length}.
   BIND(&loop);
   Node* start_index = IntPtrConstant(kUnrolledIterations * kEntrySize);
-  Node* end_index = LoadAndUntagWeakFixedArrayLength(feedback);
+  Node* end_index =
+      length != nullptr ? length : LoadAndUntagWeakFixedArrayLength(feedback);
   BuildFastLoop(
       start_index, end_index,
       [this, receiver_map, feedback, if_handler, var_handler](Node* index) {