Bug 263758 (CVE-2024-23252)

JSC version:
afe912ce640a337086d106e4853c3dabae003a38

Build options:
```
./Tools/Scripts/build-jsc --jsc-only --debug
```

Test case:
```
function foo(arg) {

	const x = /\s.\W/iu;
	x + x;

	const a = 0 | arg;
	const b = a + 0.1;
	
	const vvv = 1020000;
	const c = b >> x;
	
	return c;
}

let x = 3;

let y = -2147483647; // 0x7fffffff

let apple = foo(y);
print("function call before JIT opt")
print(apple);

for(let i=0; i<200; i++) {
	foo(x);
}
let banana = foo(y);
print("function call after JIT opt")
print(banana);
```

Result:
```
function call before JIT opt
-2147483646
function call after JIT opt
-2147483647
```