Use the property load IC for accessing the array length.

src/hydrogen-instructions.h

Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index d11835452c72d7024f2a38bb49a854eba7ce45f1..e413f13e9a3cd2c399ac1a6275aa684356cb5970 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -2167,7 +2167,8 @@ class HLoadExternalArrayPointer: public HUnaryOperation {
 class HCheckMaps: public HTemplateInstruction<2> {
  public:
   HCheckMaps(HValue* value, Handle<Map> map, Zone* zone,
-             HValue* typecheck = NULL) {
+             HValue* typecheck = NULL,
+             CompareMapMode mode = REQUIRE_EXACT_MAP) : mode_(mode) {
     SetOperandAt(0, value);
     // If callers don't depend on a typecheck, they can pass in NULL. In that
     // case we use a copy of the |value| argument as a dummy value.
@@ -2178,7 +2179,8 @@ class HCheckMaps: public HTemplateInstruction<2> {
     SetGVNFlag(kDependsOnElementsKind);
     map_set()->Add(map, zone);
   }
-  HCheckMaps(HValue* value, SmallMapList* maps, Zone* zone) {
+  HCheckMaps(HValue* value, SmallMapList* maps, Zone* zone,
+             CompareMapMode mode = REQUIRE_EXACT_MAP) : mode_(mode) {
     SetOperandAt(0, value);
     SetOperandAt(1, value);
     set_representation(Representation::Tagged());
@@ -2222,6 +2224,7 @@ class HCheckMaps: public HTemplateInstruction<2> {
 
   HValue* value() { return OperandAt(0); }
   SmallMapList* map_set() { return &map_set_; }
+  CompareMapMode mode() { return mode_; }
 
   DECLARE_CONCRETE_INSTRUCTION(CheckMaps)
 
@@ -2238,6 +2241,7 @@ class HCheckMaps: public HTemplateInstruction<2> {
 
  private:
   SmallMapList map_set_;
+  CompareMapMode mode_;
 };