Bugfix: assert in lithium compile for LMaybeGrowElements

test/mjsunit/regress/regress-585041.js

Index: test/mjsunit/regress/regress-585041.js
diff --git a/test/mjsunit/regress/regress-3650-3.js b/test/mjsunit/regress/regress-585041.js
similarity index 50%
copy from test/mjsunit/regress/regress-3650-3.js
copy to test/mjsunit/regress/regress-585041.js
index 013e4df2834e20435982300303eb6260eb41b2be..c072ed2a15befd66232f1b649b979f6b5d2a6014 100644
--- a/test/mjsunit/regress/regress-3650-3.js
+++ b/test/mjsunit/regress/regress-585041.js
@@ -4,14 +4,18 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(a) {
-  for (var d in a) {
-    delete a[1];
+function f(arr, i) {
+  arr[i] = 50;
+}
+
+function boom(dummy) {
+  var arr = new Array(10);
+  f(arr, 10);
+  if (dummy) {
+    f(arr, -2147483648);
   }
 }
 
-foo([1,2,3]);
-foo([2,3,4]);
-%OptimizeFunctionOnNextCall(foo);
-foo([1,2,3]);
-assertOptimized(foo);
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+boom(false);