Segfaults/memory corruption for large containers with size initialized from C++ (insufficient OOM checking)

**Describe the bug**

Creating a container with a very large number of items can lead to segfaults, if

**Standalone code, or other way to reproduce the problem**

```
array_fill(123, (1 << 30), null);
```

- `123` is needed to take the darray/dict path instead of the vec/varray path
- if in `hhvm -m debug`, run twice for segfault
- if in standalone script, run once with `-d hhvm.jit=0` for segfault

**Expected behavior**

OOM fatal

**Actual behavior**

Segfaults, sometimes with an OOM fatal first.

## in hphpd

req::malloc fails when parsing the line again

```
# 0 HPHP::req::malloc(unsigned long, unsigned short)
# 1 HPHP::VariableUnserializer::unserializeVariant(HPHP::tv_val, HPHP::UnserializeMode)
# 2 HPHP::VariableUnserializer::unserialize()
# 3 HPHP::(anonymous namespace)::parse_php_serialized(folly::Range)
# 4 HPHP::(anonymous namespace)::parse_attribute_list(HPHP::(anonymous namespace)::AsmState&, HPHP::AttrContext, HPHP::UserAttributeMap*) [clone .lto_priv.0]
# 5 HPHP::(anonymous namespace)::parse_function(HPHP::(anonymous namespace)::AsmState&)
# 6 HPHP::(anonymous namespace)::parse(HPHP::(anonymous namespace)::AsmState&)
# 7 HPHP::assemble_string(char const*, int, char const*, HPHP::SHA1 const&, HPHP::Native::FuncTable const&, bool)
# 8 HPHP::(anonymous namespace)::(anonymous namespace)::assemble_string_handle_errors(char const*, char const*, unsigned long, char const*, HPHP::SHA1 const&, HPHP::Native::FuncTable const&, bool&, HPHP::CompileAbortMode) [clone .lto_priv.0]
# 9 HPHP::(anonymous namespace)::hackc_compile(char const*, int, char const*, HPHP::SHA1 const&, HPHP::Native::FuncTable const&, bool, bool&, HPHP::RepoOptions const&, HPHP::CompileAbortMode) [clone .constprop.0]
# 10 HPHP::HackcUnitCompiler::compile(bool&, HPHP::CompileAbortMode)
```

## in standalone script

req-local fini nodes segfault:

```
# 0 jemalloc_je_large_prof_info_get
# 1 jemalloc_je_sdallocx_default
# 2 HPHP::rds::local::fini(bool)
# 3 HPHP::execute_program_impl(int, char**)
# 4 HPHP::execute_program(int, char**)
# 5 main
# 6 __libc_start_main
# 7 _start
```

Reproduce with array_fill(123, (1 << 30), null), using hhvm -m debug or a standalone run with -d hhvm.jit=0. Trace the darray/dict allocation path and the req::malloc, VariableUnserializer, and rds::local::fini entry points shown in the reports. Done means the reproducer produces an OOM fatal without a segfault or memory corruption.

Written by the indexing model from the issue text.