DFG JIT should speculate more aggressively on reads of array.length

DFG JIT should speculate more aggressively on reads of array.length
https://bugs.webkit.org/show_bug.cgi?id=68932

Reviewed by Oliver Hunt.

This is a 2% speed-up on Kraken, neutral elsewhere.

* dfg/DFGNode.h:
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::performNodeCSE):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@96184 268f45cc-cd09-0410-ab3c-d52691b4dbfc