Bug 881574 - Part 1: Support Array.length in GetPropertyPure. (r=bhackett)

js/src/jscntxt.h

@@ -1656,6 +1656,7 @@ struct ThreadSafeContext : js::ContextFriendFields,
 
     /* Cut outs for string operations. */
     StaticStrings &staticStrings() { return runtime_->staticStrings; }
+    JSAtomState &names() { return runtime_->atomState; }
 
     /*
      * Allocator used when allocating GCThings on this context. If we are a
@@ -1949,8 +1950,6 @@ struct JSContext : js::ThreadSafeContext,
         exception.setUndefined();
     }
 
-    JSAtomState & names() { return runtime()->atomState; }
-
 #ifdef DEBUG
     /*
      * Controls whether a quadratic-complexity assertion is performed during

js/src/jsobj.cpp

@@ -4169,25 +4169,22 @@ js::LookupPropertyPure(JSObject *obj, jsid id, JSObject **objp, Shape **propp)
  *
  *  - Any object in the lookup chain has a non-stub resolve hook.
  *  - Any object in the lookup chain is non-native.
- *  - Hashification of a shape tree into a shape table.
  *  - The property has a getter.
  */
 bool
-js::GetPropertyPure(JSObject *obj, jsid id, Value *vp)
+js::GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, jsid id, Value *vp)
 {
     JSObject *obj2;
     Shape *shape;
     if (!LookupPropertyPureInline(obj, id, &obj2, &shape))
         return false;
 
-    /*
-     * If we couldn't find the property, fail if any of the following edge
-     * cases appear.
-     */
     if (!shape) {
-        /* Do we have a non-stub class op hook? */
+        /* Fail if we have a non-stub class op hook? */
         if (obj->getClass()->getProperty && obj->getClass()->getProperty != JS_PropertyStub)
             return false;
+
+        /* Vanilla native object, return undefined. */
         vp->setUndefined();
         return true;
     }
@@ -4197,6 +4194,14 @@ js::GetPropertyPure(JSObject *obj, jsid id, Value *vp)
         return true;
     }
 
+    /* Special case 'length' on Array. */
+    if (obj->is<ArrayObject>() &&
+        (JSID_IS_ATOM(id) && tcx->names().length == JSID_TO_ATOM(id)))
+    {
+        vp->setNumber(obj->as<ArrayObject>().length());
+        return true;
+    }
+
     return NativeGetPureInline(obj2, shape, vp);
 }
 

js/src/jsobj.h

@@ -1420,12 +1420,12 @@ bool
 LookupPropertyPure(JSObject *obj, jsid id, JSObject **objp, Shape **propp);
 
 bool
-GetPropertyPure(JSObject *obj, jsid id, Value *vp);
+GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, jsid id, Value *vp);
 
 inline bool
-GetPropertyPure(JSObject *obj, PropertyName *name, Value *vp)
+GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, PropertyName *name, Value *vp)
 {
-    return GetPropertyPure(obj, NameToId(name), vp);
+    return GetPropertyPure(tcx, obj, NameToId(name), vp);
 }
 
 bool