Fix overflow in LengthBuckets for large strings

LengthBuckets.CreateLengthBucketsArrayIfAppropriate caused an
integer overflow when calculating bucket array size for very large
strings, resulting in a negative value being passed to
ArrayPool<T>.Shared.Rent. This triggered an ArgumentOutOfRangeException
when creating a FrozenDictionary with large strings approaching Array.MaxLength.

Add an overflow check to prevent creating buckets when the calculation
would overflow.

Author: prozolic

src/libraries/System.Collections.Immutable/src/System/Collections/Frozen/String/LengthBuckets.cs

@@ -27,18 +27,20 @@ internal static class LengthBuckets
                 return null;
             }
 
-            int arraySize = spread * MaxPerLength;
+            long expectedArraySize = (long)spread * MaxPerLength;
 #if NET
-            if (arraySize > Array.MaxLength)
+            if (expectedArraySize > Array.MaxLength)
 #else
-            if (arraySize > 0X7FFFFFC7)
+            if (expectedArraySize > 0X7FFFFFC7)
 #endif
             {
                 // In the future we may lower the value, as it may be quite unlikely
                 // to have a LOT of strings of different sizes.
                 return null;
             }
 
+            int arraySize = (int)expectedArraySize;
+
             // Instead of creating a dictionary of lists or a multi-dimensional array
             // we rent a single dimension array, where every bucket has five slots.
             // The bucket starts at (key.Length - minLength) * 5.