Fix speedup of typedarray-length loading in the ICs as well as Crankshaft

test/mjsunit/regress/regress-typedarray-length.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(100);
+a.__proto__ = null;
+
+function get(a) {
+  return a.length;

[Dmitry Lomov (no reviews), 2015/03/27 13:22:18]

Could you add tests for other properties as well?

Also please add tests for
class C extends Uint8Array {
   get length() { return ...; }
}

+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));