[turbofan] Specify better type for FixedArray::length field.

This avoids redundant smi checks when using the length of a FixedArray,
which is always a positve smi.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1162163003

Cr-Commit-Position: refs/heads/master@{#28746}

src/compiler/access-builder.cc

@@ -46,8 +46,13 @@ FieldAccess AccessBuilder::ForJSArrayBufferBackingStore() {
 
 // static
 FieldAccess AccessBuilder::ForFixedArrayLength() {
+  // TODO(turbofan): 2^30 is a valid upper limit for the FixedArray::length
+  // field, although it's not the best. If we had a Zone we could create an
+  // appropriate range type instead.
+  STATIC_ASSERT(FixedArray::kMaxLength <= 1 << 30);
   return {kTaggedBase, FixedArray::kLengthOffset, MaybeHandle<Name>(),
-          Type::TaggedSigned(), kMachAnyTagged};
+          Type::Intersect(Type::Unsigned30(), Type::TaggedSigned()),
+          kMachAnyTagged};
 }