This adds support to also optimize loads from special JSObject field
accessors, like String::length and JSArray::length.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417503002

Cr-Commit-Position: refs/heads/master@{#31365}