Support StringLength in hydrogen (similar to ArrayLength).

src/ast.h

Index: src/ast.h
diff --git a/src/ast.h b/src/ast.h
index a897e886dd3cf8b8d68b789dc18eb0815458d285..762a4fa018224f658b71b5405cd7e22e1b8b9531 100644
--- a/src/ast.h
+++ b/src/ast.h
@@ -1205,9 +1205,10 @@ class Property: public Expression {
         key_(key),
         pos_(pos),
         type_(type),
-        is_monomorphic_(false),
         receiver_types_(NULL),
+        is_monomorphic_(false),
         is_array_length_(false),
+        is_string_length_(false),
         is_function_prototype_(false),
         is_arguments_access_(false) { }
 
@@ -1221,6 +1222,7 @@ class Property: public Expression {
   int position() const { return pos_; }
   bool is_synthetic() const { return type_ == SYNTHETIC; }
 
+  bool IsStringLength() const { return is_string_length_; }
   bool IsFunctionPrototype() const { return is_function_prototype_; }
 
   // Marks that this is actually an argument rewritten to a keyed property
@@ -1249,11 +1251,12 @@ class Property: public Expression {
   int pos_;
   Type type_;
 
-  bool is_monomorphic_;
   ZoneMapList* receiver_types_;
-  bool is_array_length_;
-  bool is_function_prototype_;
-  bool is_arguments_access_;
+  bool is_monomorphic_ : 1;
+  bool is_array_length_ : 1;
+  bool is_string_length_ : 1;
+  bool is_function_prototype_ : 1;
+  bool is_arguments_access_ : 1;
   Handle<Map> monomorphic_receiver_type_;
 
   // Dummy property used during preparsing.