Use the property load IC for accessing the array length.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index c86c0b2f431bd08890b7250d4d59d30e770f7e25..c7325e5966990648de02a52d6a811fd201b3bb8b 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -8353,7 +8353,7 @@ class Foreign: public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(Foreign);
 };
 
-
+class PropertyIndex;

[Jakob Kummerow, 2012/11/16 12:57:10]

nit: two empty lines between top-level definitions (i.e. two before "class
PropertyIndex" and two after).

[Massi, 2012/11/19 12:26:15]

Done.

 // The JSArray describes JavaScript Arrays
 //  Such an array can be in one of two modes:
 //    - fast, backing storage is a FixedArray and length <= elements.length();
@@ -8406,6 +8406,9 @@ class JSArray: public JSObject {
   static const int kLengthOffset = JSObject::kHeaderSize;
   static const int kSize = kLengthOffset + kPointerSize;
 
+  static inline PropertyIndex ArrayLengthIndex();
+  STATIC_ASSERT(kLengthOffset % kPointerSize == 0);
+
  private:
   // Expand the fixed array backing of a fast-case JSArray to at least
   // the requested size.