[wasm] Fix regression test

Repeatedly allocating >1GB fails on stress bots, hence run a GC
in-between to free the array buffer.

R=titzer@chromium.org
CC=​mlippautz@chromium.org, ulan@chromium.org

Bug: v8:6924
Change-Id: I44761e83f62b8225148eecbc569748cd3be21d6a
Reviewed-on: https://chromium-review.googlesource.com/718109Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48541}

test/mjsunit/regress/wasm/regression-694433.js

@@ -2,5 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var size = 0x40000000;
-assertThrows(() => WebAssembly.validate(new Uint16Array(size)), RangeError);
+// Flags: --expose-gc
+
+var size = Math.floor(0xFFFFFFFF / 4) + 1;
+(function() {
+  // Note: On 32 bit, this throws in the Uint16Array constructor (size does not
+  // fit in a Smi). On 64 bit, it throws in WebAssembly.validate, because the
+  // size exceeds the internal module size limit.
+  assertThrows(() => WebAssembly.validate(new Uint16Array(size)), RangeError);
+})();
+gc();