[turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer.

TEST=mjsunit/compiler/regress-444695
BUG=chromium:444695
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/824843002

Cr-Commit-Position: refs/heads/master@{#25932}

src/compiler/simplified-lowering.cc

@@ -1147,14 +1147,18 @@ void SimplifiedLowering::DoLoadBuffer(Node* node, MachineType output_type,
     Node* const length = node->InputAt(2);
     Node* const effect = node->InputAt(3);
     Node* const control = node->InputAt(4);
+    Node* const index =
+        machine()->Is64()
+            ? graph()->NewNode(machine()->ChangeUint32ToUint64(), offset)
+            : offset;
 
     Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
     Node* branch =
         graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* etrue = graph()->NewNode(machine()->Load(type), buffer, offset,
-                                   effect, if_true);
+    Node* etrue =
+        graph()->NewNode(machine()->Load(type), buffer, index, effect, if_true);
     Node* vtrue = changer->GetRepresentationFor(etrue, type, output_type);
 
     Node* if_false = graph()->NewNode(common()->IfFalse(), branch);

test/mjsunit/compiler/regress-444695.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var foo = (function(stdlib, foreign, heap) {
+  "use asm";
+  var MEM = new stdlib.Uint8Array(heap);
+  function foo(x) { MEM[x | 0] *= 0; }
+  return {foo: foo};
+})(this, {}, new ArrayBuffer(1)).foo;
+foo(-926416896 * 8 * 1024);