Don't crash in Array.join() if the resulting string exceeds the max string length.

test/mjsunit/regress/regress-336820.js

Index: test/mjsunit/regress/regress-336820.js
diff --git a/test/mjsunit/regress/regress-334708.js b/test/mjsunit/regress/regress-336820.js
similarity index 88%
copy from test/mjsunit/regress/regress-334708.js
copy to test/mjsunit/regress/regress-336820.js
index f0291bbdab61128baad9df89457d045b66644f1b..9b466296043b858df75b7f1fe9f959b66abea969 100644
--- a/test/mjsunit/regress/regress-334708.js
+++ b/test/mjsunit/regress/regress-336820.js
@@ -25,18 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-function foo(x, y) {
-  return Math.floor(x / y);
-}
-
-function bar(x, y) {
-  return foo(x + 1, y + 1);
-}
-
-foo(16, "4");
-
-bar(64, 2);
-%OptimizeFunctionOnNextCall(bar);
-bar(64, 2);
+assertThrows((function() {
+  s = "Hello World!\n";
+  while (true) {
+    x = new Array();
+    x[0] = s;
+    x[1000] = s;
+    x[1000000] = s;
+    s = x.join("::");
+  }}), RangeError);