[turbofan] Specify better type for FixedArray::length field.

src/compiler/access-builder.cc

Index: src/compiler/access-builder.cc
diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc
index c728154d7f4e2bb263f6bdf3d9fc64ae55f97bfe..b9986f28fc3ef015b11bce76f9a2cc925fecb200 100644
--- a/src/compiler/access-builder.cc
+++ b/src/compiler/access-builder.cc
@@ -46,8 +46,13 @@ FieldAccess AccessBuilder::ForJSArrayBufferBackingStore() {
 
 // static
 FieldAccess AccessBuilder::ForFixedArrayLength() {
+  // TODO(turbofan): 2^30 is a valid upper limit for the FixedArray::length
+  // field, although it's not the best. If we had a Zone we could create an
+  // appropriate range type instead.
+  STATIC_ASSERT(FixedArray::kMaxLength <= 1 << 30);
   return {kTaggedBase, FixedArray::kLengthOffset, MaybeHandle<Name>(),
-          Type::TaggedSigned(), kMachAnyTagged};
+          Type::Intersect(Type::Unsigned30(), Type::TaggedSigned()),
+          kMachAnyTagged};
 }