Fix overflow check computation for Smi Phis

test/mjsunit/regress/regress-2836.js

Index: test/mjsunit/regress/regress-2836.js
diff --git a/test/mjsunit/regress/regress-2671-1.js b/test/mjsunit/regress/regress-2836.js
similarity index 89%
copy from test/mjsunit/regress/regress-2671-1.js
copy to test/mjsunit/regress/regress-2836.js
index 042a501e5adb86cd7d868ec721edef8edde27274..682cc5e841fa3c9d4d62106437883779ce677bc0 100644
--- a/test/mjsunit/regress/regress-2671-1.js
+++ b/test/mjsunit/regress/regress-2836.js
@@ -27,19 +27,12 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
 function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i]++;
-  assertTrue(isNaN(a[i]));
+  var end = 1073741823;  // 2^30 - 1
+  var start = end - 100000;  // Run long enough to trigger OSR.
+  for (var i = start; i <= end; ++i) {
+    assertTrue(i >= start);  // No overflow allowed!
+  }
 }
 
 f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
-