[turbofan] Fix typed lowering of JSToLength.

test/mjsunit/regress/regress-crbug-657478.js

Index: test/mjsunit/regress/regress-crbug-657478.js
diff --git a/test/mjsunit/compiler/regress-5158.js b/test/mjsunit/regress/regress-crbug-657478.js
similarity index 62%
copy from test/mjsunit/compiler/regress-5158.js
copy to test/mjsunit/regress/regress-crbug-657478.js
index ead5f4ed9d36bde7ddf9036f8f18bc11bc386ed3..0827a7a1c731843190a748f7f4fe21ca56a2b714 100644
--- a/test/mjsunit/compiler/regress-5158.js
+++ b/test/mjsunit/regress/regress-crbug-657478.js
@@ -4,13 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) {
-  x = +x;
-  return (x > 0) ? x : 0 - x;
-}
+function foo(o) { return %_ToLength(o.length); }
 
-foo(1);
-foo(-1);
-foo(0);
+foo(new Array(4));
+foo(new Array(Math.pow(2, 32) - 1));
+foo({length: 10});
 %OptimizeFunctionOnNextCall(foo);
-assertEquals(2147483648, foo(-2147483648));
+foo({length: 10});