Robustify NewNumberFromSize against int-overflow on cast

test/mjsunit/regress/regress-crbug-380671.js

Index: test/mjsunit/regress/regress-crbug-380671.js
diff --git a/test/message/destructuring-modify-const.js b/test/mjsunit/regress/regress-crbug-380671.js
similarity index 57%
copy from test/message/destructuring-modify-const.js
copy to test/mjsunit/regress/regress-crbug-380671.js
index 88bda351d8e12ef06fd895e9617dee5829824440..891215e3010de91862c9c1b60a4f9e8fe232af11 100644
--- a/test/message/destructuring-modify-const.js
+++ b/test/mjsunit/regress/regress-crbug-380671.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-destructuring-bind
-'use strict';
+// Flags: --mock-arraybuffer-allocator
 
-const { x : x, y : y } = { x : 1, y : 2 };
-x++;
+var buffer = new ArrayBuffer(0xc0000000);
+assertEquals(0xc0000000, buffer.byteLength);