Fix a bug in typed array speculation (bug 841462, r=jandem, a=bbajaj).