[turbofan] Bounds check when lowering JSStoreProperty.

src/compiler/js-graph.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_JS_GRAPH_H_
 #define V8_COMPILER_JS_GRAPH_H_
 
 #include "src/compiler/common-node-cache.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
@@ skipping 43 matching lines @@
   Node* Constant(Handle<Object> value);
 
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(double value);
 
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(int32_t value);
 
   // Creates a Int32Constant node, usually canonicalized.
   Node* Int32Constant(int32_t value);
+  Node* Uint32Constant(uint32_t value) {
+    return Int32Constant(bit_cast<int32_t>(value));
+  }
 
   // Creates a Float64Constant node, usually canonicalized.
   Node* Float64Constant(double value);
 
   // Creates an ExternalConstant node, usually canonicalized.
   Node* ExternalConstant(ExternalReference ref);
 
   Node* SmiConstant(int32_t immediate) {
     DCHECK(Smi::IsValid(immediate));
     return Constant(immediate);
@@ skipping 22 matching lines @@
   SetOncePointer<Node> nan_constant_;
 
   CommonNodeCache cache_;
 
   Node* ImmovableHeapConstant(Handle<Object> value);
   Node* NumberConstant(double value);
   Node* NewNode(const Operator* op);
 
   Factory* factory() { return isolate()->factory(); }
 };
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif