Limit the size for typed arrays to MaxSmi.

test/mjsunit/regress/regress-319722-Uint8Array.js

Index: test/mjsunit/regress/regress-319722-Uint8Array.js
diff --git a/test/mjsunit/regress/regress-2565.js b/test/mjsunit/regress/regress-319722-Uint8Array.js
similarity index 91%
copy from test/mjsunit/regress/regress-2565.js
copy to test/mjsunit/regress/regress-319722-Uint8Array.js
index a77806a62e2209d355fce393b98797f1d20f40f8..f7717f6348d0a2ffb88a19c0fee27bb4d6b669df 100644
--- a/test/mjsunit/regress/regress-2565.js
+++ b/test/mjsunit/regress/regress-319722-Uint8Array.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-Object.freeze(Object.prototype);
-var p = {};
-var o = Object.create(p);
-assertSame(p, o.__proto__);
-assertSame(p, Object.getPrototypeOf(o));
+// Flags: --nostress-opt --allow-natives-syntax
+var maxSize = %MaxSmi() + 1;
+assertThrows(function () { new Uint8Array(maxSize); }, RangeError);