[turbofan] Quickfix for invalid number truncation of typed array loads.

test/mjsunit/compiler/regress-int32array-outofbounds-nan.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 function Module(stdlib, foreign, heap) {
   "use asm";
-  var MEM32 = new stdlib.Float32Array(heap);
+  var MEM32 = new stdlib.Int32Array(heap);
   function foo(i) {
-    MEM32[0] = (i >>> 0) / 2;
-    return MEM32[0];
+    i = i|0;
+    return +MEM32[i >> 2];
   }
-  return { foo: foo };
+  return {foo: foo};
 }
 
-var foo = Module(this, {}, new ArrayBuffer(64 * 1024)).foo;
-assertEquals(0.5, foo(1));
+var foo = Module(this, {}, new ArrayBuffer(4)).foo;
+assertEquals(NaN, foo(-4));
+assertEquals(NaN, foo(4));