Fix speedup of typedarray-length loading in the ICs as well as Crankshaft

test/mjsunit/regress/regress-typedarray-length.js

Index: test/mjsunit/regress/regress-typedarray-length.js
diff --git a/test/mjsunit/regress/regress-typedarray-length.js b/test/mjsunit/regress/regress-typedarray-length.js
new file mode 100644
index 0000000000000000000000000000000000000000..f34babc231367bf1f98a5be33a876213d4bc2fb7
--- /dev/null
+++ b/test/mjsunit/regress/regress-typedarray-length.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(100);
+a.__proto__ = null;
+
+function get(a) {
+  return a.length;

[Dmitry Lomov (no reviews), 2015/03/27 13:22:18]

Could you add tests for other properties as well?

Also please add tests for
class C extends Uint8Array {
   get length() { return ...; }
}

+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));