[turbofan] Deoptimize on access to neutered typed arrays.

test/mjsunit/compiler/optimized-int32array-length.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-try {
-  %Call(1, 0);
-} catch (e) {
-  assertTrue(e instanceof TypeError);
-}
+var a = new Int32Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);