Skip spread fast-path if input string size exceeds kMaxFastArrayLength.

Bug: chromium:901944
Change-Id: Iaf1dfaa5763162ae7952381fb8b64661d85ea1a8
Reviewed-on: https://chromium-review.googlesource.com/c/1317822Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57269}

src/builtins/builtins-iterator-gen.cc

@@ -280,12 +280,17 @@ void IteratorBuiltinsAssembler::FastIterableToList(
 
   BIND(&check_string);
   {
-    Label string_fast_call(this);
+    Label string_maybe_fast_call(this);
     StringBuiltinsAssembler string_assembler(state());
     string_assembler.BranchIfStringPrimitiveWithNoCustomIteration(
-        iterable, context, &string_fast_call, &check_map);
-
-    BIND(&string_fast_call);
+        iterable, context, &string_maybe_fast_call, &check_map);
+
+    BIND(&string_maybe_fast_call);
+    TNode<IntPtrT> const length = LoadStringLengthAsWord(CAST(iterable));
+    // Use string length as conservative approximation of number of codepoints.
+    GotoIf(
+        IntPtrGreaterThan(length, IntPtrConstant(JSArray::kMaxFastArrayLength)),
+        slow);
     *var_result = CallBuiltin(Builtins::kStringToList, context, iterable);
     Goto(&done);
   }