Fix JSArray-specific length lookup in polymorphic array handling

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5683 matching lines @@
 
     set_current_block(this_map);
     HInstruction* checked_key = NULL;
     HInstruction* access = NULL;
     if (IsFastElementsKind(elements_kind)) {
       if (is_store && !IsFastDoubleElementsKind(elements_kind)) {
         AddInstruction(HCheckMaps::New(
             elements, isolate()->factory()->fixed_array_map(),
             zone(), top_info(), mapcompare));
       }
-      if (map->IsJSArray()) {
+      if (map->instance_type() == JS_ARRAY_TYPE) {
         HInstruction* length = AddLoad(object, HObjectAccess::ForArrayLength(),
                                        mapcompare, Representation::Smi());
         length->set_type(HType::Smi());
         checked_key = Add<HBoundsCheck>(key, length);
       } else {
         HInstruction* length = AddLoadFixedArrayLength(elements);
         checked_key = Add<HBoundsCheck>(key, length);
       }
       access = AddFastElementAccess(
           elements, checked_key, val, mapcompare,
@@ skipping 4245 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal