Bailout for large object allocations in full code EmitFastOneByteArrayJoin.

src/full-codegen/arm64/full-codegen-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
 #include "src/debug/debug.h"
@@ skipping 3943 matching lines @@
   // string_length to get the length of the result string.
   // Load the separator length as untagged.
   // We assume little endianness, and that the length is positive.
   __ Ldrsw(separator_length,
            UntagSmiFieldMemOperand(separator,
                                    SeqOneByteString::kLengthOffset));
   __ Sub(string_length, string_length, separator_length);
   __ Umaddl(string_length, array_length.W(), separator_length.W(),
             string_length);
 
+  // Bailout for large object allocations.
+  __ Cmp(string_length, Page::kMaxRegularHeapObjectSize);
+  __ B(gt, &bailout);
+
   // Get first element in the array.
   __ Add(element, elements, FixedArray::kHeaderSize - kHeapObjectTag);
   // Live values in registers:
   //   element: First array element
   //   separator: Separator string
   //   string_length: Length of result string (not smi)
   //   array_length: Length of the array (not smi).
   __ AllocateOneByteString(result, string_length, scratch1, scratch2, scratch3,
                            &bailout);
 
@@ skipping 1298 matching lines @@
   }
 
   return INTERRUPT;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_ARM64