Fixed the range information for string lengths.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 9da27443d9330506e705de607070b5a02f799242..1507f20dc8fd77d0dc3db9ae3afc8c4bfff2f8ce 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1580,9 +1580,7 @@ Bounds Typer::Visitor::TypeJSCallRuntime(Node* node) {
     case Runtime::kInlineMathClz32:
       return Bounds(Type::None(), Type::Range(0, 32, zone()));
     case Runtime::kInlineStringGetLength:
-      // The string::length property is always an unsigned smi.
-      return Bounds(Type::None(), Type::Intersect(Type::UnsignedSmall(),
-                                                  Type::TaggedSigned()));
+      return Bounds(Type::None(), Type::Range(0, String::kMaxLength, zone()));
     default:
       break;
   }