Make so that array length property access uses a new IC that tracks the array map.

test/mjsunit/array-length.js

Index: test/mjsunit/array-length.js
diff --git a/test/mjsunit/array-length.js b/test/mjsunit/array-length.js
index 16867db733b6c98bb45b9428b86755d6c1e58e5d..9e4979943409358b1612f76e987b61e340b1fed9 100644
--- a/test/mjsunit/array-length.js
+++ b/test/mjsunit/array-length.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 var a = [0,1,2,3];
 assertEquals(0, a.length = 0);
 
@@ -119,3 +121,32 @@ for (var i = 0; i < 7; i++) {
   t = a.length = 7;
   assertEquals(7, t);
 }
+
+function TestLengthAccess() {
+  var TestGetLength = function(a, l, getLength, getKeyedLength) {
+    assertEquals(l, getLength(a));
+    assertEquals(l, getKeyedLength(a));
+  }
+
+  var Test = function(a, l) {
+    var getLength = function(a) { return a.length; }
+    var getKeyedLength = function(a) { return a['length']; }
+    // Make the ICs reach the state we want.
+    TestGetLength(a, l, getLength, getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+    // Also test crankshaft.
+    %OptimizeFunctionOnNextCall(getLength);
+    %OptimizeFunctionOnNextCall(getKeyedLength);
+    TestGetLength(a, l, getLength, getKeyedLength);
+  }
+  
+  Test(new Array(4), 4);
+  Test([1, 2, 3, 4], 4);
+  Test(Object.create(new Array(4)), 4);
+  length = 4;
+  var globalObject = (1,eval)("this");
+  Test(globalObject, 4);
+}
+TestLengthAccess();
+