[turbofan] Quickfix for invalid number truncation of typed array loads.

test/mjsunit/compiler/regress-int32array-outofbounds-nan.js

Index: test/mjsunit/compiler/regress-int32array-outofbounds-nan.js
diff --git a/test/mjsunit/asm/float32array-store-div.js b/test/mjsunit/compiler/regress-int32array-outofbounds-nan.js
similarity index 54%
copy from test/mjsunit/asm/float32array-store-div.js
copy to test/mjsunit/compiler/regress-int32array-outofbounds-nan.js
index 78224f962b7971f2b86a5381e98e2bbd2c63ca13..2eba2a4f29f00341c2d0d4ec8c556db7de2ee24b 100644
--- a/test/mjsunit/asm/float32array-store-div.js
+++ b/test/mjsunit/compiler/regress-int32array-outofbounds-nan.js
@@ -4,13 +4,14 @@
 
 function Module(stdlib, foreign, heap) {
   "use asm";
-  var MEM32 = new stdlib.Float32Array(heap);
+  var MEM32 = new stdlib.Int32Array(heap);
   function foo(i) {
-    MEM32[0] = (i >>> 0) / 2;
-    return MEM32[0];
+    i = i|0;
+    return +MEM32[i >> 2];
   }
-  return { foo: foo };
+  return {foo: foo};
 }
 
-var foo = Module(this, {}, new ArrayBuffer(64 * 1024)).foo;
-assertEquals(0.5, foo(1));
+var foo = Module(this, {}, new ArrayBuffer(4)).foo;
+assertEquals(NaN, foo(-4));
+assertEquals(NaN, foo(4));