Limit size of dehoistable array indices

test/mjsunit/regress/regress-crbug-319860.js

Index: test/mjsunit/regress/regress-crbug-319860.js
diff --git a/test/mjsunit/regress/regress-171641.js b/test/mjsunit/regress/regress-crbug-319860.js
similarity index 85%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/regress/regress-crbug-319860.js
index 8db6781821325f8f6253eb2df4abb2b362b001c0..b81fb85ba712da96ac348b10744ec6477963b0ca 100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/regress/regress-crbug-319860.js
@@ -27,14 +27,21 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(k, p) {
+function read(a, index) {
+  var offset = 0x2000000;
+  var result;
   for (var i = 0; i < 1; i++) {
-    p = Math.min(p, i);
+    result = a[index + offset];
   }
-  m = Math.floor((k | 0) / p);
+  return result;
 }
 
-foo(0, 1);
-foo(0, 1);
-%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+var a = new Int8Array(0x2000001);
+read(a, 0);
+read(a, 0);
+%OptimizeFunctionOnNextCall(read);
+
+// Segfault maybe?
+for (var i = 0; i > -1000000; --i) {
+  read(a, i);
+}