Merge V8 5.2.361.47 DO NOT MERGE
https://chromium.googlesource.com/v8/v8/+/5.2.361.47
FPIIM-449
Change-Id: Ibec421b85a9b88cb3a432ada642e469fe7e78346
(cherry picked from commit bcf72ee8e3b26f1d0726869c7ddb3921c68b09a8)
diff --git a/test/mjsunit/regress/regress-585041.js b/test/mjsunit/regress/regress-585041.js
new file mode 100644
index 0000000..c072ed2
--- /dev/null
+++ b/test/mjsunit/regress/regress-585041.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(arr, i) {
+ arr[i] = 50;
+}
+
+function boom(dummy) {
+ var arr = new Array(10);
+ f(arr, 10);
+ if (dummy) {
+ f(arr, -2147483648);
+ }
+}
+
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+boom(false);