Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.

Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
https://bugs.webkit.org/show_bug.cgi?id=173035
<rdar://problem/32554593>

Reviewed by Geoffrey Garen and Filip Pizlo.

JSTests:

* stress/regress-173035.js: Added.

Source/JavaScriptCore:

Also added and fixed up some assertions.

* runtime/ArrayConventions.h:
* runtime/JSArray.cpp:
(JSC::JSArray::setLength):
* runtime/JSObject.cpp:
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
* runtime/JSObject.h:
(JSC::JSObject::ensureLength):
* runtime/RegExpObject.cpp:
(JSC::collectMatches):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncSplitFast):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@217869 268f45cc-cd09-0410-ab3c-d52691b4dbfc