[turbofan] Fix representation type for JSArray::length.

test/mjsunit/regress/regress-4515.js

Index: test/mjsunit/regress/regress-4515.js
diff --git a/test/mjsunit/compiler/regress-variable-liveness-let.js b/test/mjsunit/regress/regress-4515.js
similarity index 57%
copy from test/mjsunit/compiler/regress-variable-liveness-let.js
copy to test/mjsunit/regress/regress-4515.js
index 4c6b6936e58543844ec2684d56abd898217ce6cd..81610f08a59a8713ac8916481744719364b50a8e 100644
--- a/test/mjsunit/compiler/regress-variable-liveness-let.js
+++ b/test/mjsunit/regress/regress-4515.js
@@ -4,12 +4,14 @@
 
 // Flags: --allow-natives-syntax --turbo-filter=f
 
-"use strict";
-
-function f() {
-  %DeoptimizeNow();
-  let x = 23;
+function f(array) {
+  return array.length >>> 0;
 }
 
+var a = new Array();
+a[4000000000] = "A";
+
+assertEquals(4000000001, f(a));
+assertEquals(4000000001, f(a));
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(4000000001, f(a));