negative bounds checking on realm calls

test/mjsunit/regress/regress-cr-344285.js

Index: test/mjsunit/regress/regress-cr-344285.js
diff --git a/test/mjsunit/function-arguments-duplicate.js b/test/mjsunit/regress/regress-cr-344285.js
similarity index 87%
copy from test/mjsunit/function-arguments-duplicate.js
copy to test/mjsunit/regress/regress-cr-344285.js
index 80f03a106b30a7e2f984a83b9d54b2edd8fb840a..42e8bd109bb34cfb3de436af96f91104f698b836 100644
--- a/test/mjsunit/function-arguments-duplicate.js
+++ b/test/mjsunit/regress/regress-cr-344285.js
@@ -25,12 +25,13 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Execises ArgumentsAccessStub::GenerateNewNonStrictSlow.
-
-function f(a, a) {
-  assertEquals(2, a);
-  assertEquals(1, arguments[0]);
-  assertEquals(2, arguments[1]);
+function __f_1(g) { return (g/-1) ^ 1; }
+var __v_0 = 1 << 31;
+var __v_2 = __f_1(__v_0);
+caught = false;
+try {
+  Realm.eval(__v_2, "Realm.global(0).y = 1");
+} catch (e) {
+  caught = true;
 }
-
-f(1, 2);
+assertTrue(caught, "exception not caught");