Fix incorrect branch condition for JSOP_MUL overflow.

Resolves ion/bug1072188.js.
Clear the upper 32 bits of dest in mul32().

This prevents exciting tag clobbering during monoTagMove().
Implement generatePreBarrier().

Resolves ion/bug761854.js.