Add bailout for large objects when allocating arrays in optimized code.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 3486 matching lines @@
                                                    Representation::Smi());
   length_field =
       builder()->AddUncasted<HForceRepresentation>(length_field,
                                                    Representation::Smi());
 
   // Generate size calculation code here in order to make it dominate
   // the JSArray allocation.
   HValue* elements_size =
       builder()->BuildCalculateElementsSize(kind_, capacity);
 
+  // Bail out for large objects.
+  HValue* max_regular_heap_object_size =
+      builder()->Add<HConstant>(Page::kMaxRegularHeapObjectSize);
+  builder()->Add<HBoundsCheck>(elements_size, max_regular_heap_object_size);
+
   // Allocate (dealing with failure appropriately)
   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
 
   // Fill in the fields: map, properties, length
   HValue* map;
   if (allocation_site_payload_ == NULL) {
     map = EmitInternalMapCode();
   } else {
     map = EmitMapCode();
   }
@@ skipping 10144 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8