Check that index and length are Smi in bounds check.

test/mjsunit/regress/regress-crbug-142218.js

Index: test/mjsunit/regress/regress-crbug-142218.js
diff --git a/test/mjsunit/regress/regress-2045.js b/test/mjsunit/regress/regress-crbug-142218.js
similarity index 85%
copy from test/mjsunit/regress/regress-2045.js
copy to test/mjsunit/regress/regress-crbug-142218.js
index 822ee1fa4641b4a0ba15eee2c2a2e59411db7d4d..373f83bca34d915ca06cc9c6a52875a30b7ec3e5 100644
--- a/test/mjsunit/regress/regress-2045.js
+++ b/test/mjsunit/regress/regress-crbug-142218.js
@@ -27,23 +27,18 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() {
-  assertEquals(2, arguments.length);
-}
+length = 1 << 16;
+a = new Array(length);
 
-function bar() {
-  G.x;
-  return foo.apply(this, arguments);
+function insert_element(key) {
+  a[key] = 42;
 }
 
-function baz() {
-  return bar(1, 2);
+insert_element(1);
+%OptimizeFunctionOnNextCall(insert_element);
+insert_element(new Object());
+count = 0;
+for (var i = 0; i < length; i++) {
+  if (a[i] != undefined) count++;
 }
-
-G = {x: 0};
-baz();
-baz();
-%OptimizeFunctionOnNextCall(baz);
-baz();
-delete G.x;
-baz();
+assertEquals(1, count);