TypedArray length incorrectly reported in JITed code

```javascript
function f() {
let ta = new Uint8Array(5);
Object.defineProperty(ta, 'length', { value: 100 });
return ta.length;
}

print(f());
print(f());
```

Run with `ch -mic:1 -off:simplejit`

Prints
```
100
5
```

Should be 100 always.

@Penguinwizzard @boingoing