Fix Array.prototype.concat when exceeding array size limit.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 7cf744bedf29fc9c138b848d8d66d9021cd8afa0..323c8cf983ca9e704a3850790d555cdff44cf235 100644
--- a/src/array.js
+++ b/src/array.js
@@ -483,7 +483,23 @@ function ArrayConcat(arg1) {  // length == 1
     arrays[i + 1] = %_Arguments(i);
   }
 
-  return %ArrayConcat(arrays);
+  var result = %ArrayConcat(arrays);
+  if (!%_IsSmi(result)) return result;
+
+  // The result is a smi as signal that %ArrayConcat failed because the result
+  // exceeds the array size limit. Overflowing elements turn into properties.
+  var offset = 0;
+  var result = [];
+  for (var i = 0; i < arrays.length; i++) {
+    var array = arrays[i];
+    var keys = GetSortedArrayKeys(array, %GetArrayKeys(array, array.length));
+    for (var j = 0; j < keys.length; j++) {
+      var key = keys[j];
+      result[key + offset] = array[key];
+    }
+    offset += array.length;
+  }
+  return result;
 }