Disallow sequences with lengths exceeding max allocation supported.

third_party/WebKit/Source/platform/heap/HeapAllocator.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef HeapAllocator_h
 #define HeapAllocator_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/Persistent.h"
 #include "platform/heap/TraceTraits.h"
@@ skipping 33 matching lines @@
 
 // This is a static-only class used as a trait on collections to make them heap
 // allocated.  However see also HeapListHashSetAllocator.
 class PLATFORM_EXPORT HeapAllocator {
   STATIC_ONLY(HeapAllocator);
 
  public:
   using Visitor = blink::Visitor;
   static const bool isGarbageCollected = true;
 
+  template<typename T>
+  static size_t maxElementCountInBackingStore() {
+    return maxHeapObjectSize / sizeof(T);
+  }
+
   template <typename T>
   static size_t quantizedSize(size_t count) {
-    RELEASE_ASSERT(count <= maxHeapObjectSize / sizeof(T));
+    CHECK(count <= maxElementCountInBackingStore<T>());
     return ThreadHeap::allocationSizeFromSize(count * sizeof(T)) -
            sizeof(HeapObjectHeader);
   }
   template <typename T>
   static T* allocateVectorBacking(size_t size) {
     ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
     ASSERT(state->isAllocationAllowed());
     size_t gcInfoIndex = GCInfoTrait<HeapVectorBacking<T>>::index();
     NormalPageArena* arena =
         static_cast<NormalPageArena*>(state->vectorBackingArena(gcInfoIndex));
@@ skipping 765 matching lines @@
     const blink::HeapHashCountedSet<Value, HashFunctions, Traits>& set,
     VectorType& vector) {
   copyToVector(static_cast<const HashCountedSet<Value, HashFunctions, Traits,
                                                 blink::HeapAllocator>&>(set),
                vector);
 }
 
 }  // namespace WTF
 
 #endif