[turbofan] Use uint32 to store the number of control outputs instead of uint16.

test/mjsunit/regress/wasm/regression-5531.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --expose-wasm
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
   var builder = new WasmModuleBuilder();
   builder.addMemory(1, 1, false);
   builder.addFunction("foo", kSig_i_v)
     .addBody([
-              kExprI32Const, 00,
-              kExprMemorySize,
-              kExprBrIf, 00,
-              kExprMemorySize,
-              kExprBr, 0xe7, 0xd2, 0xf2, 0xff, 0x1d
+              kExprI32Const, 0x00,
+      kExprI8Const, 0xcb,
+      kExprI8Const, 0xff,
+      kExprBrTable, 0xcb, 0xcb, 0xcb, 0x00, 0x00, 0xcb, 0x00 // entries=1238475
               ])
               .exportFunc();
   assertThrows(function() { builder.instantiate(); });
 })();