Fix Array.prototype.concat when exceeding array size limit.

test/mjsunit/regress/regress-581.js

Index: test/mjsunit/regress/regress-581.js
diff --git a/test/mjsunit/regress/regress-crbug-168545.js b/test/mjsunit/regress/regress-581.js
similarity index 69%
copy from test/mjsunit/regress/regress-crbug-168545.js
copy to test/mjsunit/regress/regress-581.js
index acc065e41101325dd9b105f73e50748b1c9cff13..4810042ad1e00cbd06b32a0bbb2fc230b6fdeb75 100644
--- a/test/mjsunit/regress/regress-crbug-168545.js
+++ b/test/mjsunit/regress/regress-581.js
@@ -25,10 +25,31 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var o = {};
-Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
-assertThrows("new Int16Array(o);");
+var pow30 = Math.pow(2, 30);
+var pow31 = Math.pow(2, 31);
+var pow32 = Math.pow(2, 32);
 
 var a = [];
-Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
-assertThrows("new Int16Array(a);");
+a[pow31] = 31;
+
+assertEquals(pow31 + 1, a.length);
+var b = a.concat(a);
+// b == { (2^31) : 42, (2^32 + 1) : 42 }, only first of which is set as
+// array element.  The second one is a property and does not affect the
+// length property.
+assertEquals(pow31 + 1, b.length);
+assertTrue((pow32 + 1) in b);
+assertEquals(31, b[pow31]);
+assertEquals(31, b[pow32 + 1]);
+
+var c = [];
+c[pow30] = 30;
+c["a"] = 17;
+var d = c.concat(c, a);
+assertEquals(pow31 + 2, d.length);
+assertTrue((pow32 + 2) in d);
+assertFalse("a" in d);
+assertEquals(30, d[pow30 + 0]);
+assertEquals(30, d[pow31 + 1]);
+assertEquals(31, d[pow32 + 2]);
+