Make so that array length property access uses a new IC that tracks the array map. (issue 11344012)

[mma...@chromium.org]

Reviewers: Jakob,

Message:
This patch looks pointless but its real purpose is to make so that in
hydrogen
JSArrayLength in branches and JSArayLength used in bound checks look
exactly the
same and can get the same GVN number.
This will enable proper array bounds check elimination in a following CL.

Description:
Make so that array length property access uses a new IC that tracks the
array
map.

BUG=


Please review this at https://chromiumcodereview.appspot.com/11344012/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
M src/arm/stub-cache-arm.cc
M src/ast.cc
M src/hydrogen.cc
M src/ia32/stub-cache-ia32.cc
M src/ic.cc
M src/objects-inl.h
M src/objects.h
M src/stub-cache.h
M src/stub-cache.cc
M src/type-info.h
M src/type-info.cc
M src/x64/stub-cache-x64.cc
M test/mjsunit/array-length.js