Make so that array length property access uses a new IC that tracks the array map.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 4e7d8f8c08702943ef60fb3692b5ceb56482ec5d..14db249d6d82c246c59fec6936d98bb8167ce05f 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -3495,12 +3495,13 @@ Code::Flags Code::ComputeFlags(Kind kind,
                                StubType type,
                                int argc,
                                InlineCacheHolderFlag holder) {
-  // Extra IC state is only allowed for call IC stubs or for store IC
-  // stubs.
+  // Extra IC state is only allowed for call IC stubs, store IC stubs or
+  // load ICs with type CALLBACKS.
   ASSERT(extra_ic_state == kNoExtraICState ||
          kind == CALL_IC ||
          kind == STORE_IC ||
-         kind == KEYED_STORE_IC);
+         kind == KEYED_STORE_IC ||
+         (kind == LOAD_IC && type == CALLBACKS));
   // Compute the bit mask.
   int bits = KindField::encode(kind)
       | ICStateField::encode(ic_state)