[turbofan] Deoptimize on access to neutered typed arrays.

test/mjsunit/compiler/optimized-int32array-length.js

Index: test/mjsunit/compiler/optimized-int32array-length.js
diff --git a/test/mjsunit/call-intrinsic-type-error.js b/test/mjsunit/compiler/optimized-int32array-length.js
similarity index 50%
copy from test/mjsunit/call-intrinsic-type-error.js
copy to test/mjsunit/compiler/optimized-int32array-length.js
index 9d586977d924829f664a34c915440b5c8498dd63..250d523cc9bc41be315835e88e514ed2579ee2db 100644
--- a/test/mjsunit/call-intrinsic-type-error.js
+++ b/test/mjsunit/compiler/optimized-int32array-length.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-try {
-  %Call(1, 0);
-} catch (e) {
-  assertTrue(e instanceof TypeError);
-}
+var a = new Int32Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);