[turbofan] Properly emit bounds checks for typed array element loads.

src/compiler/simplified-lowering.h

Index: src/compiler/simplified-lowering.h
diff --git a/src/compiler/simplified-lowering.h b/src/compiler/simplified-lowering.h
index 2ba7e3bd88b469199a096ecd1f2d8c467a1171f5..2264d910b12a82e5fb24e56914849c7f82f75373 100644
--- a/src/compiler/simplified-lowering.h
+++ b/src/compiler/simplified-lowering.h
@@ -14,17 +14,19 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-class SimplifiedLowering {
+class SimplifiedLowering FINAL {
  public:
   explicit SimplifiedLowering(JSGraph* jsgraph) : jsgraph_(jsgraph) {}
-  virtual ~SimplifiedLowering() {}
+  ~SimplifiedLowering() {}
 
   void LowerAllNodes();
 
   // TODO(titzer): These are exposed for direct testing. Use a friend class.
   void DoLoadField(Node* node);
   void DoStoreField(Node* node);
-  void DoLoadElement(Node* node);
+  // TODO(turbofan): The output_type can be removed once the result of the
+  // representation analysis is stored in the node bounds.
+  void DoLoadElement(Node* node, MachineType output_type);
   void DoStoreElement(Node* node);
   void DoStringAdd(Node* node);
   void DoStringEqual(Node* node);