Merged r17711 into 3.20 branch.

test/mjsunit/regress/regress-319120.js

Index: test/mjsunit/regress/regress-319120.js
diff --git a/test/mjsunit/regress/regress-2690.js b/test/mjsunit/regress/regress-319120.js
similarity index 96%
copy from test/mjsunit/regress/regress-2690.js
copy to test/mjsunit/regress/regress-319120.js
index 5fe7dc42dc693cf7f0a3e9a2b13c0f7b306189e2..2899da25d9d9d82da0714270880cd203a9c5e96b 100644
--- a/test/mjsunit/regress/regress-2690.js
+++ b/test/mjsunit/regress/regress-319120.js
@@ -25,5 +25,4 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-assertTrue(/\1[a]/.test("\1a"));
-
+assertThrows('x = new Float64Array({length: 0x24924925})');