Make so that array length property access uses a new IC that tracks the array map.

src/type-info.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 294 matching lines @@
   return Handle<Map>::cast(GetInfo(prop->key()->LiteralFeedbackId()));
 }
 
 
 bool TypeFeedbackOracle::LoadIsBuiltin(Property* expr, Builtins::Name id) {
   return *GetInfo(expr->PropertyFeedbackId()) ==
       isolate_->builtins()->builtin(id);
 }
 
 
+Code::ExtraICStateForeignCallback TypeFeedbackOracle::LoadForeignCallbackType(
+    Property* expr) {
+  Handle<Object> map_or_code = GetInfo(expr->PropertyFeedbackId());
+  if (map_or_code->IsMap()) {
+    // If the IC is monomorphic we get the Map and not the Code object so we
+    // cannot access the extra_ic_state bits.
+    // Anyway we check the map and return the proper flag if appropriate.
+    Handle<Map> map = Handle<Map>::cast(map_or_code);
+    if (map->instance_type() == JS_ARRAY_TYPE &&
+        IsFastElementsKind(map->elements_kind()) &&
+        expr->key()->IsPropertyName() &&
+        Handle<String>::cast(expr->key()->AsLiteral()->handle())->
+        Equals(Isolate::Current()->heap()->length_symbol())) {
+      return Code::ExtraICStateForeignCallbackArrayLength;
+    }
+  } else if (map_or_code->IsCode()) {
+    Handle<Code> code = Handle<Code>::cast(map_or_code);
+    if (code->kind() == Code::LOAD_IC && code->type() == Code::CALLBACKS) {
+      return Code::ExtraICStateForeignCallback(code->extra_ic_state());
+    }
+  }
+  return Code::ExtraICStateForeignCallbackNone;
+}
+
+
 TypeInfo TypeFeedbackOracle::CompareType(CompareOperation* expr) {
   Handle<Object> object = GetInfo(expr->CompareOperationFeedbackId());
   TypeInfo unknown = TypeInfo::Unknown();
   if (!object->IsCode()) return unknown;
   Handle<Code> code = Handle<Code>::cast(object);
   if (!code->is_compare_ic_stub()) return unknown;
 
   CompareIC::State state = static_cast<CompareIC::State>(code->compare_state());
   switch (state) {
     case CompareIC::UNINITIALIZED:
@@ skipping 403 matching lines @@
   USE(maybe_result);
 #ifdef DEBUG
   Object* result = NULL;
   // Dictionary has been allocated with sufficient size for all elements.
   ASSERT(maybe_result->ToObject(&result));
   ASSERT(*dictionary_ == result);
 #endif
 }
 
 } }  // namespace v8::internal