[crankshaft] Fix Smi overflow in {HMaybeGrowElements}.

test/mjsunit/regress/regress-crbug-686427.js

Index: test/mjsunit/regress/regress-crbug-686427.js
diff --git a/test/mjsunit/regress/regress-crbug-686427.js b/test/mjsunit/regress/regress-crbug-686427.js
new file mode 100644
index 0000000000000000000000000000000000000000..b1827a4d6801fe361014c7177b0a2a8f3f894acb
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-686427.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, base) {
+  a[base + 4] = 23;
+  return a;
+}
+var i = 1073741824;
+assertEquals(23, f({}, 1)[1 + 4]);
+assertEquals(23, f([], 2)[2 + 4]);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f({}, i)[i + 4]);