[turbofan] Fix invalid bounds check with overflowing offset.

test/mjsunit/compiler/regress-445267.js

Index: test/mjsunit/compiler/regress-445267.js
diff --git a/test/mjsunit/asm/float32array-store-div.js b/test/mjsunit/compiler/regress-445267.js
similarity index 50%
copy from test/mjsunit/asm/float32array-store-div.js
copy to test/mjsunit/compiler/regress-445267.js
index 78224f962b7971f2b86a5381e98e2bbd2c63ca13..465168b6e87ae6d49696d9e67c06a7bb982ace57 100644
--- a/test/mjsunit/asm/float32array-store-div.js
+++ b/test/mjsunit/compiler/regress-445267.js
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function Module(stdlib, foreign, heap) {
+var foo = (function Module(stdlib, foreign, heap) {
   "use asm";
-  var MEM32 = new stdlib.Float32Array(heap);
+  var MEM16 = new stdlib.Int16Array(heap);
   function foo(i) {
-    MEM32[0] = (i >>> 0) / 2;
-    return MEM32[0];
+    i = i|0;
+    i = MEM16[i + 2147483650 >> 1]|0;
+    return i;
   }
   return { foo: foo };
-}
+})(this, {}, new ArrayBuffer(64 * 1024)).foo;
 
-var foo = Module(this, {}, new ArrayBuffer(64 * 1024)).foo;
-assertEquals(0.5, foo(1));
+foo(0);