Merged r14584, r14596 into 3.18 branch.

test/mjsunit/regress/regress-2671-1.js

Index: test/mjsunit/regress/regress-2671-1.js
diff --git a/test/mjsunit/regress/regress-crbug-173974.js b/test/mjsunit/regress/regress-2671-1.js
similarity index 93%
copy from test/mjsunit/regress/regress-crbug-173974.js
copy to test/mjsunit/regress/regress-2671-1.js
index 905bd6058a0ad0fe2ebe10e4c7dafbe9945cbe3b..042a501e5adb86cd7d868ec721edef8edde27274 100644
--- a/test/mjsunit/regress/regress-crbug-173974.js
+++ b/test/mjsunit/regress/regress-2671-1.js
@@ -27,10 +27,19 @@
 
 // Flags: --allow-natives-syntax
 
+var y;
 function f() {
-  var count = "";
-  count[0] --;
+  var a = [];
+  a[20] = 0;
+  y = 3;
+  var i = 7 * (y + -0);
+  a[i]++;
+  assertTrue(isNaN(a[i]));
 }
+
+f();
+f();
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
+