Merged r13828, r13847 into 3.16 branch.

Properly handle misses for StoreArrayLengthStub on ia32 and x64

Fix Array.length, String.length and Function.prototype LoadICs on x64.

BUG=v8:2566,v8:2568

R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12518006

git-svn-id: https://v8.googlecode.com/svn/branches/3.16@13904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00