Fix missing bounds check in n-arguments Array constructor.

test/mjsunit/regress/regress-3027.js

Index: test/mjsunit/regress/regress-3027.js
diff --git a/test/mjsunit/regress/regress-crbug-245424.js b/test/mjsunit/regress/regress-3027.js
similarity index 83%
copy from test/mjsunit/regress/regress-crbug-245424.js
copy to test/mjsunit/regress/regress-3027.js
index 005c8baba9492dd339b4fbdc3b48f7577b9c308a..c7ebd539b685763ae30c778922c484d64ae44e6b 100644
--- a/test/mjsunit/regress/regress-crbug-245424.js
+++ b/test/mjsunit/regress/regress-3027.js
@@ -25,17 +25,18 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Test to exceed the Heap::MaxRegularSpaceAllocationSize with an array
+// constructor call taking many arguments.
 
 function boom() {
-  var a = {
-    foo: "bar",
-    foo: "baz"
-  };
-  return a;
+  var args = [];
+  for (var i = 0; i < 125000; i++) {
+    args.push(i);
+  }
+  return Array.apply(Array, args);
 }
 
-assertEquals("baz", boom().foo);
-assertEquals("baz", boom().foo);
-%OptimizeFunctionOnNextCall(boom);
-assertEquals("baz", boom().foo);
+var array = boom();
+
+assertEquals(125000, array.length);
+assertEquals(124999, array[124999]);