Fixed the range information for string lengths.

test/unittests/compiler/js-intrinsic-lowering-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/diamond.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-operator.h"
 #include "test/unittests/compiler/graph-unittest.h"
@@ skipping 298 matching lines @@
 
 TEST_F(JSIntrinsicLoweringTest, InlineStringGetLength) {
   Node* const input = Parameter(0);
   Node* const context = Parameter(1);
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
   Reduction const r = Reduce(graph()->NewNode(
       javascript()->CallRuntime(Runtime::kInlineStringGetLength, 1), input,
       context, effect, control));
   ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsLoadField(AccessBuilder::ForStringLength(),
-                                           input, effect, control));
+  EXPECT_THAT(r.replacement(),
+              IsLoadField(AccessBuilder::ForStringLength(zone()), input, effect,
+                          control));
 }
 
 
 // -----------------------------------------------------------------------------
 // %_MathClz32
 
 
 TEST_F(JSIntrinsicLoweringTest, InlineMathClz32) {
   Node* const input = Parameter(0);
   Node* const context = Parameter(1);
@@ skipping 69 matching lines @@
                             CaptureEq(&if_false0)))))),
           IsMerge(
               IsIfTrue(AllOf(CaptureEq(&branch0),
                              IsBranch(IsObjectIsSmi(input), control))),
               AllOf(CaptureEq(&if_false0), IsIfFalse(CaptureEq(&branch0))))));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8