Never call MacroAssembler::Allocate() with incorrect size.

test/mjsunit/regress/regress-412206-1.js

Index: test/mjsunit/regress/regress-412206-1.js
diff --git a/test/mjsunit/regress/regress-crbug-387636.js b/test/mjsunit/regress/regress-412206-1.js
similarity index 55%
copy from test/mjsunit/regress/regress-crbug-387636.js
copy to test/mjsunit/regress/regress-412206-1.js
index 1e50ace45a293c8561042f1a09c8fcd505b43dc2..18010a16603e6ac05b2dc63055a92c2895d0406a 100644
--- a/test/mjsunit/regress/regress-crbug-387636.js
+++ b/test/mjsunit/regress/regress-412206-1.js
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --fold-constants --always-opt
 
 function f() {
-  [].indexOf(0x40000000);
+  %_RegExpConstructResult(-10, {}, {});
 }
 
-f();
-f();
+try { f(); } catch(e) {}
+try { f(); } catch(e) {}
 %OptimizeFunctionOnNextCall(f);
-f();
+try { f(); } catch(e) {}