[turbofan] Fix representation type for JSArray::length.

[turbofan] Fix representation type for JSArray::length.

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Committed: https://crrev.com/e121aabe3929069246b33edd71ffff355c3bb0e6
Cr-Commit-Position: refs/heads/master@{#31558}

[Benedikt Meurer, 2015-10-26 11:49:55]

Description was changed from

==========
[turbofan] Fix representation type for JSArray::length.

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515
LOG=n
==========

to

==========
[turbofan] Fix representation type for JSArray::length.

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4470
LOG=n
==========

[Benedikt Meurer, 2015-10-26 11:50:25]

Thanks for fixing. LGTM

[Michael Starzinger, 2015-10-26 11:51:52]

Description was changed from

==========
[turbofan] Fix representation type for JSArray::length.

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4470
LOG=n
==========

to

==========
[turbofan] Fix representation type for JSArray::length.

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n
==========

[Michael Starzinger, 2015-10-26 11:55:46]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2015-10-26 11:56:02]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1410393006/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1410393006/1

[commit-bot: I haz the power, 2015-10-26 12:04:10]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-26 12:04:26]

Patchset 1 (id:??) landed as
https://crrev.com/e121aabe3929069246b33edd71ffff355c3bb0e6
Cr-Commit-Position: refs/heads/master@{#31558}