Backport to 3.10 of r11696: Limit work done analyzing regexps with very large fanout.

test/mjsunit/regexp-capture.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 38 matching lines @@
 assertEquals("undefined", "y".replace(/(x)?y/,
     function($0, $1){
         return $1;
     }));
 
 // See https://bugzilla.mozilla.org/show_bug.cgi?id=476146
 assertEquals(["bbc", "b"], /^(b+|a){1,2}?bc/.exec("bbc"));
 assertEquals(["bbaa", "a", "", "a"],
              /((\3|b)\2(a)){2,}/.exec("bbaababbabaaaaabbaaaabba"));
 
+// From crbug.com/128821 - don't hang:
+"".match(/((a|i|A|I|u|o|U|O)(s|c|b|c|d|f|g|h|j|k|l|m|n|p|q|r|s|t|v|w|x|y|z|B|C|D|F|G|H|J|K|L|M|N|P|Q|R|S|T|V|W|X|Y|Z)*) de\/da([.,!?\s]|$)/);