BCE: don't assume a bounds check always gets a HArrayLength.

Deoptimizations may change it to a HPhi.

bug:22056703
Change-Id: I8995209438764dac496ed856782b147ba21f93e5
2 files changed