Make so that array length property access uses a new IC that tracks the array map.

src/type-info.cc

Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index bc6a46b4b664f095e6587ed8fa873df9868b5093..f96b0776deac72c663aa8ca5425c0689d63c0597 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -312,6 +312,31 @@ bool TypeFeedbackOracle::LoadIsBuiltin(Property* expr, Builtins::Name id) {
 }
 
 
+Code::ExtraICStateForeignCallback TypeFeedbackOracle::LoadForeignCallbackType(
+    Property* expr) {
+  Handle<Object> map_or_code = GetInfo(expr->PropertyFeedbackId());
+  if (map_or_code->IsMap()) {
+    // If the IC is monomorphic we get the Map and not the Code object so we
+    // cannot access the extra_ic_state bits.
+    // Anyway we check the map and return the proper flag if appropriate.
+    Handle<Map> map = Handle<Map>::cast(map_or_code);
+    if (map->instance_type() == JS_ARRAY_TYPE &&
+        IsFastElementsKind(map->elements_kind()) &&
+        expr->key()->IsPropertyName() &&
+        Handle<String>::cast(expr->key()->AsLiteral()->handle())->
+        Equals(Isolate::Current()->heap()->length_symbol())) {
+      return Code::ExtraICStateForeignCallbackArrayLength;
+    }
+  } else if (map_or_code->IsCode()) {
+    Handle<Code> code = Handle<Code>::cast(map_or_code);
+    if (code->kind() == Code::LOAD_IC && code->type() == Code::CALLBACKS) {
+      return Code::ExtraICStateForeignCallback(code->extra_ic_state());
+    }
+  }
+  return Code::ExtraICStateForeignCallbackNone;
+}
+
+
 TypeInfo TypeFeedbackOracle::CompareType(CompareOperation* expr) {
   Handle<Object> object = GetInfo(expr->CompareOperationFeedbackId());
   TypeInfo unknown = TypeInfo::Unknown();