Fix Array.prototype.concat when exceeding array size limit.

Fix Array.prototype.concat when exceeding array size limit.


R=verwaest@chromium.org
BUG=v8:581
Committed: https://code.google.com/p/v8/source/detail?r=14154

[Toon Verwaest, 2013-04-04 12:52:24]

lgtm with comment

https://chromiumcodereview.appspot.com/13465008/diff/1/src/runtime.cc
File src/runtime.cc (right):

https://chromiumcodereview.appspot.com/13465008/diff/1/src/runtime.cc#newcode...
src/runtime.cc:8973: if (i >= JSObject::kMaxElementCount - index_offset_) {
Seems like an off-by-one error.
What about index_offset_ + i < JSObject::kMaxElementCount?

[Toon Verwaest, 2013-04-04 17:30:05]

As discussed offline, but now for the record:
ECMAScript 6 specifies that the length property needs to be set after copying
all values, with strictmode=true. This implies that an exception will have to be
thrown, rather than returning the array. So instead of manually copying in
JavaScript and turning elements into properties, we just have to throw this
exception.

[Yang, 2013-04-05 15:13:08]

Committed patchset #3 manually as r14154 (presubmit successful).