Ensure we don't overflow in BCE

src/hydrogen-bce.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen-bce.h"
 
 namespace v8 {
 namespace internal {
 
 
@@ skipping 38 matching lines @@
       is_sub = true;
       if (index->right()->IsConstant()) {
         constant = HConstant::cast(index->right());
         index_base = index->left();
       }
     } else if (check->index()->IsConstant()) {
       index_base = check->block()->graph()->GetConstant0();
       constant = HConstant::cast(check->index());
     }
 
-    if (constant != NULL && constant->HasInteger32Value()) {
+    if (constant != NULL && constant->HasInteger32Value() &&
+        constant->Integer32Value() != kMinInt) {
       *offset = is_sub ? - constant->Integer32Value()
                        : constant->Integer32Value();
     } else {
       *offset = 0;
       index_base = check->index();
     }
 
     return new(zone) BoundsCheckKey(index_base, check->length());
   }
 
@@ skipping 386 matching lines @@
     if (data->FatherInDominatorTree()) {
       table_.Insert(data->Key(), data->FatherInDominatorTree(), zone());
     } else {
       table_.Delete(data->Key());
     }
     data = data->NextInBasicBlock();
   }
 }
 
 } }  // namespace v8::internal