Use the property load IC for accessing the array length.

test/mjsunit/array-length.js

Index: test/mjsunit/array-length.js
diff --git a/test/mjsunit/array-length.js b/test/mjsunit/array-length.js
index 16867db733b6c98bb45b9428b86755d6c1e58e5d..7c3063ee1c0fbd2bfa4dcd2626ef4164403a0832 100644
--- a/test/mjsunit/array-length.js
+++ b/test/mjsunit/array-length.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 var a = [0,1,2,3];
 assertEquals(0, a.length = 0);
 
@@ -119,3 +121,42 @@ for (var i = 0; i < 7; i++) {
   t = a.length = 7;
   assertEquals(7, t);
 }
+
+function TestLengthAccess() {
+  var TestGetLength = function(a, l, getLength, getKeyedLength) {
+    assertEquals(l, getLength(a));
+    assertEquals(l, getKeyedLength(a));
+  }
+
+  var Test = function(a, l, getLength, getKeyedLength) {
+    // Make the ICs reach the state we want.
+    TestGetLength(a, l, getLength, getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+    // Also test crankshaft.
+    %OptimizeFunctionOnNextCall(getLength);
+    %OptimizeFunctionOnNextCall(getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+  }
+
+  var getLength = function(a) { return a.length; }
+  var getKeyedLength = function(a) { return a['length']; }
+  Test(new Array(4), 4, getLength, getKeyedLength);
+
+  getLength = function(a) { return a.length; }
+  getKeyedLength = function(a) { return a['length']; }
+  Test([1, 2, 3, 4], 4, getLength, getKeyedLength);
+
+  getLength = function(a) { return a.length; }
+  getKeyedLength = function(a) { return a['length']; }
+  Test(Object.create(new Array(4)), 4, getLength, getKeyedLength);
+
+  getLength = function(a) { return a.length; }
+  getKeyedLength = function(a) { return a['length']; }
+  // Set the 'length' of the global object.
+  length = 4;
+  var globalObject = (1,eval)("this");
+  Test(globalObject, 4, getLength, getKeyedLength);
+}
+TestLengthAccess();
+