Fix a bug when narrowing the result type of a field get.

pkg/compiler/lib/src/ssa/optimize.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 abstract class OptimizationPhase {
   String get name;
   void visitGraph(HGraph graph);
 }
@@ skipping 246 matching lines @@
         HConstant constantInput = actualReceiver;
         StringConstantValue constant = constantInput.constant;
         return graph.addConstantInt(constant.length, compiler);
       } else if (actualReceiver.isConstantList()) {
         HConstant constantInput = actualReceiver;
         ListConstantValue constant = constantInput.constant;
         return graph.addConstantInt(constant.length, compiler);
       }
       Element element = backend.jsIndexableLength;
       bool isFixed = isFixedLength(actualReceiver.instructionType, compiler);
+      TypeMask actualType = node.instructionType;
+      ClassWorld classWorld = compiler.world;
+      TypeMask resultType = backend.positiveIntType;
+      // If we already have computed a more specific type, keep that type.
+      if (actualType.satisfies(backend.jsUInt31Class, classWorld)) {
+        resultType = backend.uint31Type;
+      } else if (actualType.satisfies(backend.jsUInt32Class, classWorld)) {
+        resultType = backend.uint32Type;
+      }
       HFieldGet result = new HFieldGet(
-          element, actualReceiver, backend.positiveIntType,
+          element, actualReceiver, resultType,
           isAssignable: !isFixed);
       return result;
     } else if (actualReceiver.isConstantMap()) {
       HConstant constantInput = actualReceiver;
       MapConstantValue constant = constantInput.constant;
       return graph.addConstantInt(constant.length, compiler);
     }
     return null;
   }
 
@@ skipping 2007 matching lines @@
 
     keyedValues.forEach((receiver, values) {
       result.keyedValues[receiver] =
           new Map<HInstruction, HInstruction>.from(values);
     });
 
     result.nonEscapingReceivers.addAll(nonEscapingReceivers);
     return result;
   }
 }