Make so that array length property access uses a new IC that tracks the array map.

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 6614 matching lines @@
   expr->RecordTypeFeedback(oracle(), zone());
 
   if (TryArgumentsAccess(expr)) return;
 
   CHECK_ALIVE(VisitForValue(expr->obj()));
 
   HInstruction* instr = NULL;
   if (expr->AsProperty()->IsArrayLength()) {
     HValue* array = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(array));
-    HInstruction* mapcheck =
-        AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
-    instr = new(zone()) HJSArrayLength(array, mapcheck);
+    HInstruction* mapcheck = NULL;
+    HType type = HType::Tagged();
+    if (expr->IsMonomorphic()) {
+      Handle<Map> map = expr->GetReceiverTypes()->first();
+      if (IsFastElementsKind(map->elements_kind())) {
+        // In this case we know that the array length is a SMI and we do a
+        // map check instead of an IsArray check: this makes so that GVN will
+        // match this length access with the one used by the bounds check.
+        mapcheck = new(zone()) HCheckMaps(array, map, zone());
+        AddInstruction(mapcheck);
+        type = HType::Smi();
+      }
+    }
+    if (mapcheck == NULL) {
+      mapcheck =
+          AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
+    }
+    instr = new(zone()) HJSArrayLength(array, mapcheck, type);
   } else if (expr->IsStringLength()) {
     HValue* string = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(string));
     AddInstruction(HCheckInstanceType::NewIsString(string, zone()));
     instr = new(zone()) HStringLength(string);
   } else if (expr->IsStringAccess()) {
     CHECK_ALIVE(VisitForValue(expr->key()));
     HValue* index = Pop();
     HValue* string = Pop();
     HValue* context = environment()->LookupContext();
@@ skipping 3325 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal