Fixed the range information for string lengths.

src/compiler/js-intrinsic-lowering.cc

 
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include <stack>
 
 #include "src/compiler/access-builder.h"
@@ skipping 276 matching lines @@
   NodeProperties::RemoveBounds(node);
   NodeProperties::ReplaceWithValue(node, string, node);
   return Changed(node);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceStringGetLength(Node* node) {
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  return Change(node, simplified()->LoadField(AccessBuilder::ForStringLength()),
+  return Change(node, simplified()->LoadField(
+                          AccessBuilder::ForStringLength(graph()->zone())),
                 value, effect, control);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceUnLikely(Node* node, BranchHint hint) {
   std::stack<Node*> nodes_to_visit;
   nodes_to_visit.push(node);
   while (!nodes_to_visit.empty()) {
     Node* current = nodes_to_visit.top();
     nodes_to_visit.pop();
@@ skipping 115 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSIntrinsicLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8