[turbofan] Fix representation type for JSArray::length.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 320 matching lines @@
         field_type = Type::Intersect(
             Type::Range(0.0, String::kMaxLength, graph()->zone()),
             Type::TaggedSigned(), graph()->zone());
       } else if (map->IsJSArrayMap()) {
         DCHECK(Name::Equals(factory()->length_string(), name));
         // The JSArray::length property is a smi in the range
         // [0, FixedDoubleArray::kMaxLength] in case of fast double
         // elements, a smi in the range [0, FixedArray::kMaxLength]
         // in case of other fast elements, and [0, kMaxUInt32-1] in
         // case of other arrays.
+        Type* field_type_rep = Type::Tagged();
         double field_type_upper = kMaxUInt32 - 1;
         if (IsFastElementsKind(map->elements_kind())) {
+          field_type_rep = Type::TaggedSigned();
           field_type_upper = IsFastDoubleElementsKind(map->elements_kind())
                                  ? FixedDoubleArray::kMaxLength
                                  : FixedArray::kMaxLength;
         }
         field_type =
             Type::Intersect(Type::Range(0.0, field_type_upper, graph()->zone()),
-                            Type::TaggedSigned(), graph()->zone());
+                            field_type_rep, graph()->zone());
       }
       *access_info = PropertyAccessInfo::DataField(receiver_type, field_index,
                                                    field_type, holder);
       return true;
     }
 
     // Lookup the named property on the {map}.
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
@@ skipping 580 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8