Remove broken optimization unwrapping number wrappers on setting array.length

Can't imagine it's very useful; lets restore/fix once it becomes relevant

BUG=

Review URL: https://codereview.chromium.org/1198253002

Cr-Commit-Position: refs/heads/master@{#29181}

src/accessors.cc

@@ -193,16 +193,7 @@ static bool FastAsArrayLength(Isolate* isolate, Handle<Object> value,
   // We don't support AsArrayLength, so use AsArrayIndex for now. This just
   // misses out on kMaxUInt32.
   if (value->IsString()) return String::cast(*value)->AsArrayIndex(length);
-  if (!value->IsJSValue()) return false;
-  Handle<JSValue> wrapper = Handle<JSValue>::cast(value);
-  DCHECK(wrapper->GetIsolate()
-             ->native_context()
-             ->number_function()
-             ->has_initial_map());
-  // Only support fast unwrapping for the initial map. Otherwise valueOf might
-  // have been overwritten, in which case unwrapping is invalid.
-  if (wrapper->map() != isolate->number_function()->initial_map()) return false;
-  return wrapper->value()->ToArrayIndex(length);
+  return false;
 }
 
 

test/mjsunit/array-length.js

@@ -105,6 +105,13 @@ var a = new Array();
 assertEquals(Object(12), a.length = new Number(12));
 assertEquals(12, a.length);
 
+Number.prototype.valueOf = function() { return 10; }
+var n = new Number(100);
+assertEquals(n, a.length = n);
+assertEquals(10, a.length);
+n.valueOf = function() { return 20; }
+assertEquals(n, a.length = n);
+assertEquals(20, a.length);
 
 var o = { length: -23 };
 Array.prototype.pop.apply(o);