[turbofan] Length and index2 are unsigned in CheckedLoad/CheckedStore.

test/mjsunit/regress/regress-599719.js

Index: test/mjsunit/regress/regress-599719.js
diff --git a/test/mjsunit/regress/regress-599719.js b/test/mjsunit/regress/regress-599719.js
new file mode 100644
index 0000000000000000000000000000000000000000..579fa1fc48681cfdb6e5f4877dea371da9554595
--- /dev/null
+++ b/test/mjsunit/regress/regress-599719.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-wasm
+
+function __f_7() {
+    %DeoptimizeFunction(__f_5);
+}
+function __f_8(global, env) {
+  "use asm";
+  var __f_7 = env.__f_7;
+  function __f_9(i4, i5) {
+    i4 = i4 | 0;
+    i5 = i5 | 0;
+    __f_7();
+  }
+  return {'__f_9': __f_9}
+}
+function __f_5() {
+  var __v_5 = Wasm.instantiateModuleFromAsm( __f_8.toString(), {'__f_7': __f_7});
+  __v_5.__f_9(0, 0, 0);
+}
+__f_5();