[heap, runtime] Set upper limit on the size of fast fixed arrays that

are created using new Array(N) and setLength(N).

Currently the limit is based on max old generation size, which
will break with the upcoming change that allows large heaps.

BUG=chromium:652721

Review-Url: https://codereview.chromium.org/2513923002
Cr-Commit-Position: refs/heads/master@{#41112}

src/objects-inl.h

@@ -8131,11 +8131,13 @@ void JSArray::set_length(Smi* length) {
 
 
 bool JSArray::SetLengthWouldNormalize(Heap* heap, uint32_t new_length) {
+  // This constant is somewhat arbitrary. Any large enough value would work.
+  const uint32_t kMaxFastArrayLength = 32 * 1024 * 1024;
   // If the new array won't fit in a some non-trivial fraction of the max old
   // space size, then force it to go dictionary mode.
-  uint32_t max_fast_array_size =
+  uint32_t heap_based_upper_bound =
       static_cast<uint32_t>((heap->MaxOldGenerationSize() / kDoubleSize) / 4);
-  return new_length >= max_fast_array_size;
+  return new_length >= Min(kMaxFastArrayLength, heap_based_upper_bound);
 }