Add a value range analysis phase to remove bounds checks.

lib/compiler/implementation/ssa/nodes.dart

Index: lib/compiler/implementation/ssa/nodes.dart
===================================================================
--- lib/compiler/implementation/ssa/nodes.dart	(revision 12781)
+++ lib/compiler/implementation/ssa/nodes.dart	(working copy)
@@ -51,6 +51,7 @@
   R visitNot(HNot node);
   R visitParameterValue(HParameterValue node);
   R visitPhi(HPhi node);
+  R visitRangeConversion(HRangeConversion node);
   R visitReturn(HReturn node);
   R visitShiftLeft(HShiftLeft node);
   R visitShiftRight(HShiftRight node);
@@ -315,6 +316,7 @@
   visitPhi(HPhi node) => visitInstruction(node);
   visitMultiply(HMultiply node) => visitBinaryArithmetic(node);
   visitParameterValue(HParameterValue node) => visitLocalValue(node);
+  visitRangeConversion(HRangeConversion node) => visitCheck(node);
   visitReturn(HReturn node) => visitControlFlow(node);
   visitShiftRight(HShiftRight node) => visitBinaryBitOp(node);
   visitShiftLeft(HShiftLeft node) => visitBinaryBitOp(node);
@@ -707,16 +709,18 @@
   void forEachPhi(void f(HPhi phi)) {
     HPhi current = phis.first;
     while (current !== null) {
+      HInstruction saved = current.next;
       f(current);
-      current = current.next;
+      current = saved;
     }
   }
 
   void forEachInstruction(void f(HInstruction instruction)) {
     HInstruction current = first;
     while (current !== null) {
+      HInstruction saved = current.next;
       f(current);
-      current = current.next;
+      current = saved;
     }
   }
 
@@ -1192,7 +1196,8 @@
   static const int ALWAYS_FALSE = 0;
   static const int FULL_CHECK = 1;
   static const int ALWAYS_ABOVE_ZERO = 2;
-  static const int ALWAYS_TRUE = 3;
+  static const int ALWAYS_BELOW_LENGTH = 3;
+  static const int ALWAYS_TRUE = 4;
   /**
    * Details which tests have been done statically during compilation.
    * Default is that all checks must be performed dynamically.
@@ -2566,6 +2571,14 @@
   }
 }
 
+class HRangeConversion extends HCheck {
+  HRangeConversion(HInstruction input) : super(<HInstruction>[input]) {
+    sourceElement = input.sourceElement;
+  }
+  accept(HVisitor visitor) => visitor.visitRangeConversion(this);
+  HType get guaranteedType => HType.INTEGER;
+}
+
 class HStringConcat extends HInstruction {
   final Node node;
   HStringConcat(HInstruction left, HInstruction right, this.node)