Fix beyond-heap load on x64 Crankshafted StringCharFromCode

test/mjsunit/regress/regress-235311.js

Index: test/mjsunit/regress/regress-235311.js
diff --git a/test/mjsunit/regress/regress-2566.js b/test/mjsunit/regress/regress-235311.js
similarity index 91%
copy from test/mjsunit/regress/regress-2566.js
copy to test/mjsunit/regress/regress-235311.js
index 582bad979606008d8b6b9ffa080824fd18e58479..300714718f75e3ab084687af21aa1bf145e16678 100644
--- a/test/mjsunit/regress/regress-2566.js
+++ b/test/mjsunit/regress/regress-235311.js
@@ -25,10 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-function setProp(obj, prop, val) {
-  obj[prop] = val;
+var new_space_string = "";
+for (var i = 0; i < 12800; ++i) {
+  new_space_string +=
+      String.fromCharCode(Math.random() * 26 + (4294967295) | 0);
 }
-var obj = [];
-setProp(obj, 'length', 1);
-setProp(obj, 0, 5);
-assertEquals(1, obj.length);