Make so that array length property access uses a new IC that tracks the array map.

src/ia32/stub-cache-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2982 matching lines @@
 
   // Return the generated code.
   return GetCode(Code::CALLBACKS, name);
 }
 
 
 #undef __
 #define __ ACCESS_MASM(masm)
 
 
+void LoadStubCompiler::GenerateLoadArrayLength(
+    MacroAssembler* masm,
+    Register holder) {
+  // ----------- S t a t e -------------
+  //  -- ecx    : name
+  //  -- edx    : receiver
+  //  -- esp[0] : return address
+  // -----------------------------------
+
+  // Load length directly from the JS array.
+  __ mov(eax, FieldOperand(holder, JSArray::kLengthOffset));
+  __ ret(0);
+}
+
+
+#undef __
+#define __ ACCESS_MASM(masm())
+
+
+Handle<Code> LoadStubCompiler::CompileLoadArrayLength(
+    Handle<String> name,
+    Handle<JSObject> receiver,
+    Handle<JSObject> holder) {
+  // ----------- S t a t e -------------
+  //  -- ecx    : name
+  //  -- edx    : receiver
+  //  -- esp[0] : return address
+  // -----------------------------------
+  Label miss;
+
+  // Check that the maps haven't changed.
+  __ JumpIfSmi(edx, &miss);
+  Register holder_reg = CheckPrototypes(
+      receiver, edx, holder, ebx, eax, edi, name, &miss);
+
+  GenerateLoadArrayLength(masm(), holder_reg);
+
+  __ bind(&miss);
+  GenerateLoadMiss(masm(), Code::LOAD_IC);
+
+  // Return the generated code.
+  return GetCode(Code::CALLBACKS, name,
+                 Code::ExtraICStateForeignCallbackArrayLength);
+}
+
+
+#undef __
+#define __ ACCESS_MASM(masm)
+
+
 void LoadStubCompiler::GenerateLoadViaGetter(MacroAssembler* masm,
                                              Handle<JSFunction> getter) {
   // ----------- S t a t e -------------
   //  -- ecx    : name
   //  -- edx    : receiver
   //  -- esp[0] : return address
   // -----------------------------------
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
 
@@ skipping 1340 matching lines @@
     __ jmp(ic_slow, RelocInfo::CODE_TARGET);
   }
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32