[turbofan] Don't crash when typing load from a Uint8ClampedArray.

test/mjsunit/compiler/regress-446156.js

Index: test/mjsunit/compiler/regress-446156.js
diff --git a/test/mjsunit/compiler/regress-444508.js b/test/mjsunit/compiler/regress-446156.js
similarity index 66%
copy from test/mjsunit/compiler/regress-444508.js
copy to test/mjsunit/compiler/regress-446156.js
index e7d51ae831fd0c20dcbac1e825ac3740bcb7e953..f3cd2dd94ee0a466f9b1ee00fce9172588e1af88 100644
--- a/test/mjsunit/compiler/regress-444508.js
+++ b/test/mjsunit/compiler/regress-446156.js
@@ -1,4 +1,4 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -6,6 +6,6 @@
   "use asm";
   // This is not valid asm.js, but should nevertheless work.
   var MEM = new Uint8ClampedArray(heap);
-  function foo(i) { MEM[0] = 1; }
+  function foo(  )  { MEM[0] ^=  1; }
   return {foo: foo};
-})(this, {}, new ArrayBuffer(64 * 1024)).foo();
+})(this, {}, new ArrayBuffer(  ) ).foo();