[turbofan] Length and index2 are unsigned in CheckedLoad/CheckedStore.

test/mjsunit/regress/regress-599717.js

Index: test/mjsunit/regress/regress-599717.js
diff --git a/test/mjsunit/regress/regress-599717.js b/test/mjsunit/regress/regress-599717.js
new file mode 100644
index 0000000000000000000000000000000000000000..2cfd7fc8b1d33e88a6efc0f9b4ee9bfb599ebde1
--- /dev/null
+++ b/test/mjsunit/regress/regress-599717.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+function __f_61(stdlib, buffer) {
+  "use asm";
+  var __v_14 = new stdlib.Float64Array(buffer);
+  function __f_74() {
+    var __v_35 = 6.0;
+    __v_14[2] = __v_35 + 1.0;
+  }
+  return {__f_74: __f_74};
+}
+var ok = false;
+try {
+  var __v_12 = new ArrayBuffer(2147483648);
+  ok = true;
+} catch (e) {
+  // Can happen on 32 bit systems.
+}
+if (ok) {
+  var module = Wasm.instantiateModuleFromAsm( __f_61.toString(), null, __v_12);
+}