Use the property load IC for accessing the array length.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index c86c0b2f431bd08890b7250d4d59d30e770f7e25..e95a481a425a24bc52591b0696580ff34ae96635 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -8354,6 +8354,9 @@ class Foreign: public HeapObject {
 };
 
 
+class PropertyIndex;
+
+
 // The JSArray describes JavaScript Arrays
 //  Such an array can be in one of two modes:
 //    - fast, backing storage is a FixedArray and length <= elements.length();
@@ -8406,6 +8409,9 @@ class JSArray: public JSObject {
   static const int kLengthOffset = JSObject::kHeaderSize;
   static const int kSize = kLengthOffset + kPointerSize;
 
+  static inline PropertyIndex ArrayLengthIndex();
+  STATIC_ASSERT(kLengthOffset % kPointerSize == 0);
+
  private:
   // Expand the fixed array backing of a fast-case JSArray to at least
   // the requested size.