[turbofan] The upper bound for JSArray::length is max uint32.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index e83ca073d79bf2cd5005b991739c000fbede3312..4c818cf185ec5e6ddd3e514650dc5b3ed4f73e1b 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -339,10 +339,10 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
         // The JSArray::length property is a smi in the range
         // [0, FixedDoubleArray::kMaxLength] in case of fast double
         // elements, a smi in the range [0, FixedArray::kMaxLength]
-        // in case of other fast elements, and [0, kMaxUInt32-1] in
+        // in case of other fast elements, and [0, kMaxUInt32] in
         // case of other arrays.
         Type* field_type_rep = Type::Tagged();
-        double field_type_upper = kMaxUInt32 - 1;
+        double field_type_upper = kMaxUInt32;
         if (IsFastElementsKind(map->elements_kind())) {
           field_type_rep = Type::TaggedSigned();
           field_type_upper = IsFastDoubleElementsKind(map->elements_kind())