Do not eliminate GuardFieldInstr when guarding list length.

runtime/vm/intermediate_language.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/intermediate_language.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/bit_vector.h"
 #include "vm/dart_entry.h"
 #include "vm/flow_graph_allocator.h"
@@ skipping 1561 matching lines @@
 
   return unary_checks().HasReceiverClassId(value_cid) ? NULL : this;
 }
 
 
 Instruction* GuardFieldInstr::Canonicalize(FlowGraph* flow_graph) {
   if (field().guarded_cid() == kDynamicCid) {
     return NULL;  // Nothing to guard.
   }
 
+  if (field().guarded_list_length() != Field::kNoFixedLength) {
+    // We are still guarding the list length.
+    return this;
+  }
+
   if (field().is_nullable() && value()->Type()->IsNull()) {
     return NULL;
   }
 
   const intptr_t cid = field().is_nullable() ? value()->Type()->ToNullableCid()
                                              : value()->Type()->ToCid();
   if (field().guarded_cid() == cid) {
     return NULL;  // Value is guaranteed to have this cid.
   }
 
@@ skipping 1071 matching lines @@
       return kCosRuntimeEntry;
     default:
       UNREACHABLE();
   }
   return kSinRuntimeEntry;
 }
 
 #undef __
 
 }  // namespace dart