Make so that array length property access uses a new IC that tracks the array map.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 374e54c97389e448721421ca80898aeb6d42df1d..356107bc4e2d8998d165192d36bd84252fc3c8a2 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6632,9 +6632,24 @@ void HGraphBuilder::VisitProperty(Property* expr) {
   if (expr->AsProperty()->IsArrayLength()) {
     HValue* array = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(array));
-    HInstruction* mapcheck =
-        AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
-    instr = new(zone()) HJSArrayLength(array, mapcheck);
+    HInstruction* mapcheck = NULL;
+    HType type = HType::Tagged();
+    if (expr->IsMonomorphic()) {
+      Handle<Map> map = expr->GetReceiverTypes()->first();
+      if (IsFastElementsKind(map->elements_kind())) {
+        // In this case we know that the array length is a SMI and we do a
+        // map check instead of an IsArray check: this makes so that GVN will
+        // match this length access with the one used by the bounds check.
+        mapcheck = new(zone()) HCheckMaps(array, map, zone());
+        AddInstruction(mapcheck);
+        type = HType::Smi();
+      }
+    }
+    if (mapcheck == NULL) {
+      mapcheck =
+          AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
+    }
+    instr = new(zone()) HJSArrayLength(array, mapcheck, type);
   } else if (expr->IsStringLength()) {
     HValue* string = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(string));