The current code generator uses a SUBU/BLEZ combination, but this
breaks for non-zero-based arrays.  Given a lower bound 'b', length
'l', and an index 'i', Mini generates:

  real_i = i - b;
  COND_EXC_LE_UN(l, real_i);

Without this patch, the backend generates for e.g. b=42, l=1 and i=0:

  SUBU real_i, 0, 42     => -42
  SUBU at, 1, real_i     => 43 (U only means "no trap.")
  BLEZ at, throw         => No throw because at is positive!

This causes the following sequence to be used instead:

  SUBU real_i, 0, 42     => -42
  SLTU at, real_i, 1     => 0 (Unsigned '<'; real_i is a large value)
  BEQ  at, zero, throw   => Throw.

Commit contributed under the MIT/X11 license.

Generated methods always place 'this' in a0, but unboxing trampolines
currently bump a1 for functions returning value types (the register
assignments for 'this' and return area pointers probably got swapped
at some point, but the trampoline generator was not updated).

Fix that by always bumping a0.

Commit contributed under the MIT/X11 license.

From the comment:

$TARGET handles overflow by clipping, but this test assumes no overflow
handling.  According to ECMA the result of float->int conversion is undefined
if overflow occurs, so both behaviours are valid.

Commit contributed under the MIT/X11 license.