Throw exception on invalid string length instead of OOM.

test/mjsunit/string-oom-slow-escape.js

Index: test/mjsunit/string-oom-slow-escape.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js b/test/mjsunit/string-oom-slow-escape.js
similarity index 55%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/string-oom-slow-escape.js
index c85531c5fd917daa67b54e87141a164b90f3729b..34088c0efc63659aec6ee0f42ca946d58976eb4a 100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/string-oom-slow-escape.js
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-delete Object.prototype.__proto__;
 
-function f() {
-  this.toString = 1;
+var a = '<';
+for (var i = 0; i < 26; i++) a += a;
+a = a + a + a;
+
+function escape_a() {
+  escape(a);
 }
 
-f.apply({});
-f();
+assertThrows(escape_a, RangeError);