Reland "Add bailout for large objects when allocating arrays in optimized code."

This reverts commit dc0adc56.

NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1392853009

Cr-Commit-Position: refs/heads/master@{#31284}

src/hydrogen.cc

@@ -3514,6 +3514,11 @@ HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
   HValue* elements_size =
       builder()->BuildCalculateElementsSize(kind_, capacity);
 
+  // Bail out for large objects.
+  HValue* max_regular_heap_object_size =
+      builder()->Add<HConstant>(Page::kMaxRegularHeapObjectSize);
+  builder()->Add<HBoundsCheck>(elements_size, max_regular_heap_object_size);
+
   // Allocate (dealing with failure appropriately)
   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
 

test/mjsunit/mjsunit.status

@@ -696,6 +696,9 @@
   'readonly': [SKIP],
   'array-feedback': [SKIP],
 
+  # Bounds check triggers forced deopt for array constructors.
+  'array-constructor-feedback': [SKIP],
+
   # Deopting uses just enough memory to make this one OOM.
   'regress/regress-3976': [SKIP],