[turbofan] Improve typing for string::length property.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 67e2c55b29aa59c5d4c873f8af238e588753e41d..2bf3ecd857cca9695584beda6510ad9dfdd797fd 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1518,6 +1518,10 @@ Bounds Typer::Visitor::TypeJSCallRuntime(Node* node) {
     case Runtime::kInlineMathFloor:
     case Runtime::kInlineMathSqrt:
       return Bounds(Type::None(zone()), Type::Number());
+    case Runtime::kInlineStringGetLength:
+      // The string::length property is always an unsigned smi.
+      return Bounds(Type::None(), Type::Intersect(Type::UnsignedSmall(),
+                                                  Type::TaggedSigned()));
     default:
       break;
   }