[stubs] Properly handle length overflow in StringAddStub.

test/mjsunit/regress/regress-crbug-627934.js

Index: test/mjsunit/regress/regress-crbug-627934.js
diff --git a/test/mjsunit/regress/regress-crbug-600257.js b/test/mjsunit/regress/regress-crbug-627934.js
similarity index 62%
copy from test/mjsunit/regress/regress-crbug-600257.js
copy to test/mjsunit/regress/regress-crbug-627934.js
index 87bd2e39af387cde81f9c9adb15756f8139a03a3..242dc4a78ec8bb94b317fa1d5c8caf76d4fed04f 100644
--- a/test/mjsunit/regress/regress-crbug-600257.js
+++ b/test/mjsunit/regress/regress-crbug-627934.js
@@ -2,12 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stack-size=100
-
-(function rec() {
+var x = "1".repeat(32 * 1024 * 1024);
+for (var z = x;;) {
   try {
-    rec();
+    z += {toString: function() { return x; }};
   } catch (e) {
-    /{/;
+    break;
   }
-})();
+}