Fix Array.prototype.concat when exceeding array size limit.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 5fe1f9dc5bcb33a93581e2f2ed100d58cfe5c5f0..7f0d38f7e1b4f9eda62885cf4f403dcdadfa4219 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -8962,14 +8962,18 @@ class ArrayConcatVisitor {
       storage_(Handle<FixedArray>::cast(
           isolate->global_handles()->Create(*storage))),
       index_offset_(0u),
-      fast_elements_(fast_elements) { }
+      fast_elements_(fast_elements),
+      exceeds_array_limit_(false) { }
 
   ~ArrayConcatVisitor() {
     clear_storage();
   }
 
   void visit(uint32_t i, Handle<Object> elm) {
-    if (i >= JSObject::kMaxElementCount - index_offset_) return;
+    if (i >= JSObject::kMaxElementCount - index_offset_) {

[Toon Verwaest, 2013/04/04 12:52:24]

Seems like an off-by-one error.
What about index_offset_ + i < JSObject::kMaxElementCount?

+      exceeds_array_limit_ = true;
+      return;
+    }
     uint32_t index = index_offset_ + i;
 
     if (fast_elements_) {
@@ -9004,7 +9008,12 @@ class ArrayConcatVisitor {
     }
   }
 
-  Handle<JSArray> ToArray() {
+  Handle<Object> ToArray() {
+    if (exceeds_array_limit_) {
+      // Index exceeds the array size limit, so that elements would be stored
+      // as properties are missing.
+      return Handle<Smi>(Smi::FromInt(0), isolate_);
+    }
     Handle<JSArray> array = isolate_->factory()->NewJSArray(0);
     Handle<Object> length =
         isolate_->factory()->NewNumber(static_cast<double>(index_offset_));
@@ -9063,6 +9072,7 @@ class ArrayConcatVisitor {
   // JSObject::kMaxElementCount.
   uint32_t index_offset_;
   bool fast_elements_;
+  bool exceeds_array_limit_;
 };