[turbofan] Bounds check when lowering JSStoreProperty.

src/compiler/js-graph.h

Index: src/compiler/js-graph.h
diff --git a/src/compiler/js-graph.h b/src/compiler/js-graph.h
index 019ccc4369b10991dc82d0b17c1e2513d31bdc72..4ed0fdedbbbcc741e6569046f5e0f0572a5902cd 100644
--- a/src/compiler/js-graph.h
+++ b/src/compiler/js-graph.h
@@ -61,6 +61,9 @@ class JSGraph : public ZoneObject {
 
   // Creates a Int32Constant node, usually canonicalized.
   Node* Int32Constant(int32_t value);
+  Node* Uint32Constant(uint32_t value) {
+    return Int32Constant(bit_cast<int32_t>(value));
+  }
 
   // Creates a Float64Constant node, usually canonicalized.
   Node* Float64Constant(double value);
@@ -103,6 +106,7 @@ class JSGraph : public ZoneObject {
 
   Factory* factory() { return isolate()->factory(); }
 };
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8