[KeyedLoadIC] Fix negative index handling for TypedArrays

A recent refactoring accidentally disabled the code path that keeps
negative indices for TypedArrays on the fast path.

Change-Id: I89bbb414f54d04f85af77c6d205705906925c61e
Reviewed-on: https://chromium-review.googlesource.com/1164469Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54932}

src/ic/ic.cc

@@ -1150,7 +1150,7 @@ bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
   // For regular JSReceiver or String receivers, the {key} must be a positive
   // array index.
   if (receiver->IsJSReceiver() || receiver->IsString()) {
-    return key->ToArrayIndex(index);
+    if (key->ToArrayIndex(index)) return true;
   }
   // For JSTypedArray receivers, we can also support negative keys, which we
   // just map into the [2**31, 2**32 - 1] range via a bit_cast. This is valid