Make so that array length property access uses a new IC that tracks the array map.

src/x64/stub-cache-x64.cc

Index: src/x64/stub-cache-x64.cc
diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc
index cd71086eecf7a5a41733064d244df1e5815bdb46..30fa7e90dd258bd6210566639dc0d98e1f12bef4 100644
--- a/src/x64/stub-cache-x64.cc
+++ b/src/x64/stub-cache-x64.cc
@@ -2823,6 +2823,56 @@ Handle<Code> LoadStubCompiler::CompileLoadCallback(
 #define __ ACCESS_MASM(masm)
 
 
+void LoadStubCompiler::GenerateLoadArrayLength(
+    MacroAssembler* masm,
+    Register holder) {
+  // ----------- S t a t e -------------
+  //  -- rax    : receiver
+  //  -- rcx    : name
+  //  -- rsp[0] : return address
+  // -----------------------------------
+
+  // Load length directly from the JS array.
+  __ movq(rax, FieldOperand(holder, JSArray::kLengthOffset));
+  __ ret(0);
+}
+
+
+#undef __
+#define __ ACCESS_MASM(masm())
+
+
+Handle<Code> LoadStubCompiler::CompileLoadArrayLength(
+    Handle<String> name,
+    Handle<JSObject> receiver,
+    Handle<JSObject> holder) {
+  // ----------- S t a t e -------------
+  //  -- rax    : receiver
+  //  -- rcx    : name
+  //  -- rsp[0] : return address
+  // -----------------------------------
+  Label miss;
+
+  // Check that the maps haven't changed.
+  __ JumpIfSmi(rax, &miss);
+  Register holder_reg = CheckPrototypes(
+      receiver, rax, holder, rbx, rdx, rdi, name, &miss);
+
+  GenerateLoadArrayLength(masm(), holder_reg);
+
+  __ bind(&miss);
+  GenerateLoadMiss(masm(), Code::LOAD_IC);
+
+  // Return the generated code.
+  return GetCode(Code::CALLBACKS, name,
+                 Code::ExtraICStateForeignCallbackArrayLength);
+}
+
+
+#undef __
+#define __ ACCESS_MASM(masm)
+
+
 void LoadStubCompiler::GenerateLoadViaGetter(MacroAssembler* masm,
                                              Handle<JSFunction> getter) {
   // ----------- S t a t e -------------