Clusterfuzz identified overflow check needed in dehoisting.

test/mjsunit/regress/regress-380092.js

Index: test/mjsunit/regress/regress-380092.js
diff --git a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js b/test/mjsunit/regress/regress-380092.js
similarity index 56%
copy from test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
copy to test/mjsunit/regress/regress-380092.js
index 658d776ea3b80cd00d256a5514603bdb3df1f179..a7634355ca5d0db9a867cb691b05129b984911f8 100644
--- a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
+++ b/test/mjsunit/regress/regress-380092.js
@@ -4,18 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function g() {
-  arguments.length;
+function many_hoist(o, index) {
+  return o[index + 33554427];
 }
 
-var global = "";
-
-function f() {
-  global.dummy = this;
-  g({});
-}
-
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var obj = {};
+many_hoist(obj, 0);
+%OptimizeFunctionOnNextCall(many_hoist);
+many_hoist(obj, 5);