Revert r13025 and r13026 (they introduced a bug on arm and regressed octane crypto).

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 19f6eda38b4ccb7f36fb1ed352c2a1de71d73e37..bf2a649f7f298d1e53fb53b035b5dcfb323a7ee7 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -855,6 +855,26 @@ MaybeObject* LoadIC::Load(State state,
       return Smi::FromInt(String::cast(*string)->length());
     }
 
+    // Use specialized code for getting the length of arrays.
+    if (object->IsJSArray() &&
+        name->Equals(isolate()->heap()->length_symbol())) {
+      Handle<Code> stub;
+      if (state == UNINITIALIZED) {
+        stub = pre_monomorphic_stub();
+      } else if (state == PREMONOMORPHIC) {
+        stub = isolate()->builtins()->LoadIC_ArrayLength();
+      } else if (state != MEGAMORPHIC) {
+        stub = megamorphic_stub();
+      }
+      if (!stub.is_null()) {
+        set_target(*stub);
+#ifdef DEBUG
+        if (FLAG_trace_ic) PrintF("[LoadIC : +#length /array]\n");
+#endif
+      }
+      return JSArray::cast(*object)->length();
+    }
+
     // Use specialized code for getting prototype of functions.
     if (object->IsJSFunction() &&
         name->Equals(isolate()->heap()->prototype_symbol()) &&
@@ -986,17 +1006,6 @@ void LoadIC::UpdateCaches(LookupResult* lookup,
           if (!holder->HasFastProperties()) return;
           code = isolate()->stub_cache()->ComputeLoadViaGetter(
               name, receiver, holder, Handle<JSFunction>::cast(getter));
-        } else if (holder->IsJSArray() &&
-            name->Equals(isolate()->heap()->length_symbol())) {
-          ASSERT(callback->IsForeign());
-          ASSERT(reinterpret_cast<AccessorDescriptor*>(
-              Handle<Foreign>::cast(callback)->foreign_address())
-              == &Accessors::ArrayLength);
-          // Use a "load field" IC for getting the array length.
-          // Note that the resulting code object is marked as "Code::FIELD"
-          // and not as "Code::CALLBACKS".
-          code = isolate()->stub_cache()->ComputeLoadField(
-              name, receiver, holder, JSArray::ArrayLengthIndex());
         } else {
           ASSERT(callback->IsForeign());
           // No IC support for old-style native accessors.