[turbofan] Add support for accessing Uint8ClampedArrays.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index d95b2101789f4781899e9441c32513d8712417a2..7ade44c6c18e011b27e18d160cf14e55a2190e0b 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -1200,6 +1200,14 @@ JSNativeContextSpecialization::BuildElementAccess(
         value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                           effect, control);
 
+        // Introduce the appropriate truncation for {value}. Currently we
+        // only need to do this for ClamedUint8Array {receiver}s, as the
+        // other truncations are implicit in the StoreTypedElement, but we
+        // might want to change that at some point.
+        if (external_array_type == kExternalUint8ClampedArray) {
+          value = graph()->NewNode(simplified()->NumberToUint8Clamped(), value);
+        }
+
         // Check if we can skip the out-of-bounds store.
         if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
           Node* check =