Bailout for large object allocations in full code EmitFastOneByteArrayJoin.

src/full-codegen/x64/full-codegen-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
 #include "src/debug/debug.h"
@@ skipping 4148 matching lines @@
   // string: Separator string.
 
   // Add (separator length times (array_length - 1)) to string_length.
   __ SmiToInteger32(scratch,
                     FieldOperand(string, SeqOneByteString::kLengthOffset));
   __ decl(index);
   __ imull(scratch, index);
   __ j(overflow, &bailout);
   __ addl(string_length, scratch);
   __ j(overflow, &bailout);
+  __ jmp(&bailout);
+
+  // Bailout for large object allocations.
+  __ cmpl(string_length, Immediate(Page::kMaxRegularHeapObjectSize));
+  __ j(greater, &bailout);
 
   // Live registers and stack values:
   //   string_length: Total length of result string.
   //   elements: FixedArray of strings.
   __ AllocateOneByteString(result_pos, string_length, scratch, index, string,
                            &bailout);
   __ movp(result_operand, result_pos);
   __ leap(result_pos, FieldOperand(result_pos, SeqOneByteString::kHeaderSize));
 
   __ movp(string, separator_operand);
@@ skipping 993 matching lines @@
             Assembler::target_address_at(call_target_address,
                                          unoptimized_code));
   return OSR_AFTER_STACK_CHECK;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64