When we know the value being serialized is a JSArray, we can downcast and call length() directly instead of doing a generic get().
Created attachment 252825 [details] Patch
Comment on attachment 252825 [details] Patch r=me
Comment on attachment 252825 [details] Patch Clearing flags on attachment: 252825 Committed r184107: <http://trac.webkit.org/changeset/184107>
All reviewed patches have been landed. Closing bug.