Disallow sequences with lengths exceeding max allocation supported.

third_party/WebKit/Source/platform/heap/HeapAllocator.h

Index: third_party/WebKit/Source/platform/heap/HeapAllocator.h
diff --git a/third_party/WebKit/Source/platform/heap/HeapAllocator.h b/third_party/WebKit/Source/platform/heap/HeapAllocator.h
index ec391a18a4d308435f9fd96553bd01d8bbdaf2db..645e7761f7a0e7d14d532bf07ed497eb07884d6f 100644
--- a/third_party/WebKit/Source/platform/heap/HeapAllocator.h
+++ b/third_party/WebKit/Source/platform/heap/HeapAllocator.h
@@ -51,9 +51,14 @@ class PLATFORM_EXPORT HeapAllocator {
   using Visitor = blink::Visitor;
   static const bool isGarbageCollected = true;
 
+  template<typename T>
+  static size_t maxElementCountInBackingStore() {
+    return maxHeapObjectSize / sizeof(T);
+  }
+
   template <typename T>
   static size_t quantizedSize(size_t count) {
-    RELEASE_ASSERT(count <= maxHeapObjectSize / sizeof(T));
+    CHECK(count <= maxElementCountInBackingStore<T>());
     return ThreadHeap::allocationSizeFromSize(count * sizeof(T)) -
            sizeof(HeapObjectHeader);
   }