[turbofan] Fix invalid bounds check with overflowing offset.

test/mjsunit/compiler/regress-445267.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function Module(stdlib, foreign, heap) {
+var foo = (function Module(stdlib, foreign, heap) {
   "use asm";
-  var MEM32 = new stdlib.Float32Array(heap);
+  var MEM16 = new stdlib.Int16Array(heap);
   function foo(i) {
-    MEM32[0] = (i >>> 0) / 2;
-    return MEM32[0];
+    i = i|0;
+    i = MEM16[i + 2147483650 >> 1]|0;
+    return i;
   }
   return { foo: foo };
-}
+})(this, {}, new ArrayBuffer(64 * 1024)).foo;
 
-var foo = Module(this, {}, new ArrayBuffer(64 * 1024)).foo;
-assertEquals(0.5, foo(1));
+foo(0);