Throw when case mapping result > max string length

test/intl/general/case-mapping.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --icu_case_mapping
 
 // Some edge cases that unibrow got wrong
 
 assertEquals("𐐘", "𐑀".toUpperCase());
 assertEquals("𐑀", "𐐘".toLowerCase());
@@ skipping 118 matching lines @@
 assertEquals("\u{1D400}\u{1D41A}", "\u{1D400}\u{1D41A}".toUpperCase());
 assertEquals("\u{1D400}\u{1D41A}", "\u{1D400}\u{1D41A}".toLowerCase());
 // Plane 1; New characters in Unicode 8.0
 assertEquals("\u{10C80}", "\u{10CC0}".toUpperCase());
 assertEquals("\u{10CC0}", "\u{10C80}".toLowerCase());
 assertEquals("\u{10C80}", "\u{10CC0}".toLocaleUpperCase());
 assertEquals("\u{10CC0}", "\u{10C80}".toLocaleLowerCase());
 assertEquals("\u{10C80}", "\u{10CC0}".toLocaleUpperCase(["tr"]));
 assertEquals("\u{10C80}", "\u{10CC0}".toLocaleUpperCase(["tr"]));
 assertEquals("\u{10CC0}", "\u{10C80}".toLocaleLowerCase());
+
+// If the result of case mapping is longer than the max string length
+// (1<<28 - 16), it should throw a range error instead of crashing.
+var invalidValues = [
+  { c: "\u0390", opType: 0 },
+  { c: "ß", opType: 0 },
+  { c: "\uFB01", opType: 0 }, // fi ligature
+  { c: "\uFB04", opType: 0 }, // ffl ligature
+  { c: "\u0390", opType: 1, locale: "und" },
+  { c: "\u00CC", opType: 2, locale: "lt" },
+  { c: "\u0130", opType: 2, locale: "en" },
+];
+
+for (var {c, opType, locale} of invalidValues) {
+  var s = c.repeat(1<<27);
+  switch (opType) {
+    case 0:
+      assertThrows(() => s.toUpperCase(), RangeError);
+      break;
+    case 1:
+      assertThrows(() => s.toLocaleUpperCase(locale), RangeError);
+      break;
+    case 2:
+      assertThrows(() => s.toLocaleLowerCase(locale), RangeError);
+      break;
+  }
+}