[turbofan] Fix typing rule for CheckBounds.

So far we used the minimum of the length instead of the maximum to
compute the output type of the CheckBounds, but at the same time
we never really used the output type yet.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2306443003
Cr-Commit-Position: refs/heads/master@{#39114}

src/compiler/simplified-lowering.cc

@@ -2090,21 +2090,20 @@ class RepresentationSelector {
 
       case IrOpcode::kCheckBounds: {
         Type* index_type = TypeOf(node->InputAt(0));
+        Type* length_type = TypeOf(node->InputAt(1));
         if (index_type->Is(Type::Unsigned32())) {
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
+          if (lower() && index_type->Max() < length_type->Min()) {
+            // The bounds check is redundant if we already know that
+            // the index is within the bounds of [0.0, length[.
+            DeferReplacement(node, node->InputAt(0));
+          }
         } else {
           VisitBinop(node, UseInfo::CheckedSigned32AsWord32(),
                      UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
         }
-        if (lower()) {
-          // The bounds check is redundant if we already know that
-          // the index is within the bounds of [0.0, length[.
-          if (index_type->Is(NodeProperties::GetType(node))) {
-            DeferReplacement(node, node->InputAt(0));
-          }
-        }
         return;
       }
       case IrOpcode::kCheckIf: {

src/compiler/typer.cc

@@ -1569,7 +1569,7 @@ Type* Typer::Visitor::TypeCheckBounds(Node* node) {
   index = Type::Intersect(index, Type::Integral32(), zone());
   if (!index->IsInhabited() || !length->IsInhabited()) return Type::None();
   double min = std::max(index->Min(), 0.0);
-  double max = std::min(index->Max(), length->Min() - 1);
+  double max = std::min(index->Max(), length->Max() - 1);
   if (max < min) return Type::None();
   return Type::Range(min, max, zone());
 }