Optimize typed-array length loading.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 824a3cd9dbf850cfa6e25ec255b81d9301d6d573..b5cebbe327e10f9612bfd8cdee581ed7fc80b0d2 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4630,6 +4630,13 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::CanLoadAsMonomorphic(
     return true;
   }
 
+  if (IsTypedArrayLength()) {
+    for (int i = 1; i < types->length(); ++i) {
+      if (types->at(i)->instance_type() != JS_TYPED_ARRAY_TYPE) return false;
+    }
+    return true;
+  }
+
   for (int i = 1; i < types->length(); ++i) {
     PropertyAccessInfo test_info(isolate(), types->at(i), name_);
     if (!test_info.IsCompatibleForLoad(this)) return false;
@@ -4657,6 +4664,11 @@ HInstruction* HOptimizedGraphBuilder::BuildLoadMonomorphic(
             info->map()->elements_kind()));
   }
 
+  if (info->IsTypedArrayLength()) {
+    return New<HLoadNamedField>(
+        checked_object, HObjectAccess::ForTypedArrayLength());
+  }
+
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));