Make value range analysis tolerate erroneous length expressions.

pkg/compiler/lib/src/ssa/value_range_analyzer.dart

Index: pkg/compiler/lib/src/ssa/value_range_analyzer.dart
diff --git a/pkg/compiler/lib/src/ssa/value_range_analyzer.dart b/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
index c89a8ce7a94cb9abe3fe5176d11fdcaa3692edac..3d05dc84687e305dc1a9bf7951aebd93a2f89101 100644
--- a/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
+++ b/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
@@ -711,6 +711,12 @@ class SsaValueRangeAnalyzer extends HBaseVisitor implements OptimizationPhase {
       indexRange = info.newUnboundRange();
       assert(!check.index.isInteger(compiler));
     }
+    if (lengthRange == null) {
+      // We might have lost the length range due to a type conversion that
+      // asserts a non-integer type. In such a case, the program will never
+      // get to this point anyway, so no need to try and refine ranges.
+      return indexRange;
+    }
     assert(check.length.isInteger(compiler));
 
     // Check if the index is strictly below the upper bound of the length