[crankshaft] Protect against deopt loops from string length overflows.

test/mjsunit/regress/regress-5404.js

Index: test/mjsunit/regress/regress-5404.js
diff --git a/test/mjsunit/compiler/regress-5074.js b/test/mjsunit/regress/regress-5404.js
similarity index 53%
copy from test/mjsunit/compiler/regress-5074.js
copy to test/mjsunit/regress/regress-5404.js
index 903b54ad980042d134428d1c9be329499530cdef..652db4bdb5d57d159935f790d34709a6cf029f90 100644
--- a/test/mjsunit/compiler/regress-5074.js
+++ b/test/mjsunit/regress/regress-5404.js
@@ -4,15 +4,18 @@
 
 // Flags: --allow-natives-syntax
 
-var s = [,0.1];
-
 function foo(a, b) {
-  var x = s[a];
-  s[1] = 0.1;
-  return x + b;
+  return a + "0123456789012";
 }
 
-assertEquals(2.1, foo(1, 2));
-assertEquals(2.1, foo(1, 2));
+foo("a");
+foo("a");
+%OptimizeFunctionOnNextCall(foo);
+foo("a");
+
+var a = "a".repeat(268435440);
+assertThrows(function() { foo(a); });
+
 %OptimizeFunctionOnNextCall(foo);
-assertEquals("undefined2", foo(0, "2"));
+assertThrows(function() { foo(a); });
+assertOptimized(foo);