v8: DoS (out-of-bounds read) in DehoistArrayIndex function in hydrogen.cc

The DehoistArrayIndex function in hydrogen-dehoist.cc aka hydrogen.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service out-of-bounds read via JavaScript code that sets a variable to the value of an array element with...