Fix a bug when narrowing the result type of a field get.

pkg/compiler/lib/src/ssa/optimize.dart

Index: pkg/compiler/lib/src/ssa/optimize.dart
diff --git a/pkg/compiler/lib/src/ssa/optimize.dart b/pkg/compiler/lib/src/ssa/optimize.dart
index 1529104454cef20120ba4ec7e4c021b412f22844..953a6f48f96a5881dff9bd33dfd6c001729d8e91 100644
--- a/pkg/compiler/lib/src/ssa/optimize.dart
+++ b/pkg/compiler/lib/src/ssa/optimize.dart
@@ -264,8 +264,17 @@ class SsaInstructionSimplifier extends HBaseVisitor
       }
       Element element = backend.jsIndexableLength;
       bool isFixed = isFixedLength(actualReceiver.instructionType, compiler);
+      TypeMask actualType = node.instructionType;
+      ClassWorld classWorld = compiler.world;
+      TypeMask resultType = backend.positiveIntType;
+      // If we already have computed a more specific type, keep that type.
+      if (actualType.satisfies(backend.jsUInt31Class, classWorld)) {
+        resultType = backend.uint31Type;
+      } else if (actualType.satisfies(backend.jsUInt32Class, classWorld)) {
+        resultType = backend.uint32Type;
+      }
       HFieldGet result = new HFieldGet(
-          element, actualReceiver, backend.positiveIntType,
+          element, actualReceiver, resultType,
           isAssignable: !isFixed);
       return result;
     } else if (actualReceiver.isConstantMap()) {