[turbofan] Use uint32 to store the number of control outputs instead of uint16.

test/mjsunit/regress/wasm/regression-5531.js

Index: test/mjsunit/regress/wasm/regression-5531.js
diff --git a/test/mjsunit/regress/wasm/regression-654377.js b/test/mjsunit/regress/wasm/regression-5531.js
similarity index 75%
copy from test/mjsunit/regress/wasm/regression-654377.js
copy to test/mjsunit/regress/wasm/regression-5531.js
index 871da72114f4ee7ba8ed260aed52e46f26b423ee..9c1c092519fad02cb221d1b091849e4ca662daf3 100644
--- a/test/mjsunit/regress/wasm/regression-654377.js
+++ b/test/mjsunit/regress/wasm/regression-5531.js
@@ -12,11 +12,10 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   builder.addMemory(1, 1, false);
   builder.addFunction("foo", kSig_i_v)
     .addBody([
-              kExprI32Const, 00,
-              kExprMemorySize,
-              kExprBrIf, 00,
-              kExprMemorySize,
-              kExprBr, 0xe7, 0xd2, 0xf2, 0xff, 0x1d
+              kExprI32Const, 0x00,
+      kExprI8Const, 0xcb,
+      kExprI8Const, 0xff,
+      kExprBrTable, 0xcb, 0xcb, 0xcb, 0x00, 0x00, 0xcb, 0x00 // entries=1238475
               ])
               .exportFunc();
   assertThrows(function() { builder.instantiate(); });