Fix for issue 351261.

test/mjsunit/regress/regress-351261.js

Index: test/mjsunit/regress/regress-351261.js
diff --git a/test/mjsunit/regress/regress-346587.js b/test/mjsunit/regress/regress-351261.js
similarity index 57%
copy from test/mjsunit/regress/regress-346587.js
copy to test/mjsunit/regress/regress-351261.js
index 40e3ac116cdfd9984a7ac07bf09f357bc9e03506..48af5442fdc9b837a0259cceccdbfd3cf66f1a1d 100644
--- a/test/mjsunit/regress/regress-346587.js
+++ b/test/mjsunit/regress/regress-351261.js
@@ -2,17 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --fold-constants --allow-natives-syntax
+// Flags: --allow-natives-syntax --fold-constants
 
-function bar(obj) {
-  assertTrue(obj.x === 'baz');
+function store(a) {
+  a[5000000] = 1;
 }
 
 function foo() {
-  bar({ x : 'baz' });
+  var __v_8 = new Object;
+  var __v_7 = new Array(4999990);
+  store(__v_8);
+  store(__v_7);
 }
-
-foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();