Make so that array length property access uses a new IC that tracks the array map.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index dd0bb10e1057ad61f3f162727d1c1a66144178e7..6ecd3caf5ff81eeaf30cebe9631691bcedfac5bb 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -852,26 +852,6 @@ MaybeObject* LoadIC::Load(State state,
       return Smi::FromInt(String::cast(*string)->length());
     }
 
-    // Use specialized code for getting the length of arrays.
-    if (object->IsJSArray() &&
-        name->Equals(isolate()->heap()->length_symbol())) {
-      Handle<Code> stub;
-      if (state == UNINITIALIZED) {
-        stub = pre_monomorphic_stub();
-      } else if (state == PREMONOMORPHIC) {
-        stub = isolate()->builtins()->LoadIC_ArrayLength();
-      } else if (state != MEGAMORPHIC) {
-        stub = megamorphic_stub();
-      }
-      if (!stub.is_null()) {
-        set_target(*stub);
-#ifdef DEBUG
-        if (FLAG_trace_ic) PrintF("[LoadIC : +#length /array]\n");
-#endif
-      }
-      return JSArray::cast(*object)->length();
-    }
-
     // Use specialized code for getting prototype of functions.
     if (object->IsJSFunction() &&
         name->Equals(isolate()->heap()->prototype_symbol()) &&
@@ -1004,9 +984,16 @@ void LoadIC::UpdateCaches(LookupResult* lookup,
           code = isolate()->stub_cache()->ComputeLoadViaGetter(
               name, receiver, holder, Handle<JSFunction>::cast(getter));
         } else {
-          ASSERT(callback->IsForeign());
-          // No IC support for old-style native accessors.
-          return;
+          // we have IC support only for getting the array length property.
+          if (holder->IsJSArray() &&
+              name->Equals(isolate()->heap()->length_symbol())) {
+            ASSERT(reinterpret_cast<AccessorDescriptor*>(
+                Handle<Foreign>::cast(callback)->foreign_address())
+                == &Accessors::ArrayLength);
+            code = isolate()->stub_cache()->ComputeLoadArrayLength(
+                name, receiver, holder);
+          }
+          if (code.is_null()) return;
         }
         break;
       }