Protect error message formatter against invalid string length.

test/mjsunit/regress/regress-500980.js

Index: test/mjsunit/regress/regress-500980.js
diff --git a/test/message/arrow-bare-rest-param.js b/test/mjsunit/regress/regress-500980.js
similarity index 57%
copy from test/message/arrow-bare-rest-param.js
copy to test/mjsunit/regress/regress-500980.js
index 9b3916d95952e7eb3f5cd61d02f634a994071c43..841d26aa4a64882a26cf2bc572ff0844082e4885 100644
--- a/test/message/arrow-bare-rest-param.js
+++ b/test/mjsunit/regress/regress-500980.js
@@ -1,7 +1,7 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-rest-parameters --harmony-arrow-functions
 
-...x => 10
+var a = "a";
+assertThrows(function() { while (true) a += a; }, RangeError);
+assertThrows(function() { a in a; }, TypeError);