[turbofan] Deoptimize on access to neutered typed arrays.

test/mjsunit/compiler/optimized-float64array-length.js

Index: test/mjsunit/compiler/optimized-float64array-length.js
diff --git a/test/mjsunit/call-intrinsic-type-error.js b/test/mjsunit/compiler/optimized-float64array-length.js
similarity index 50%
copy from test/mjsunit/call-intrinsic-type-error.js
copy to test/mjsunit/compiler/optimized-float64array-length.js
index 9d586977d924829f664a34c915440b5c8498dd63..f6a3d77677f96ecd97b9ada53eaff6244aee8944 100644
--- a/test/mjsunit/call-intrinsic-type-error.js
+++ b/test/mjsunit/compiler/optimized-float64array-length.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-try {
-  %Call(1, 0);
-} catch (e) {
-  assertTrue(e instanceof TypeError);
-}
+var a = new Float64Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);