Fix Array.prototype.concat when exceeding array size limit.

test/mjsunit/regress/regress-581.js

Index: test/mjsunit/regress/regress-581.js
diff --git a/test/mjsunit/regress/regress-crbug-168545.js b/test/mjsunit/regress/regress-581.js
similarity index 79%
copy from test/mjsunit/regress/regress-crbug-168545.js
copy to test/mjsunit/regress/regress-581.js
index acc065e41101325dd9b105f73e50748b1c9cff13..65cd87de010c06a91952c3a7c41a4e7ab46b914e 100644
--- a/test/mjsunit/regress/regress-crbug-168545.js
+++ b/test/mjsunit/regress/regress-581.js
@@ -25,10 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var o = {};
-Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
-assertThrows("new Int16Array(o);");
+var pow30 = Math.pow(2, 30);
+var pow31 = Math.pow(2, 31);
 
 var a = [];
-Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
-assertThrows("new Int16Array(a);");
+a[pow31] = 31;
+
+assertEquals(pow31 + 1, a.length);
+assertThrows(function() { a.concat(a); }, RangeError);
+
+var b = [];
+b[pow31 - 2] = 32;
+var ab = a.concat(b);
+assertEquals(2 * pow31 - 1, ab.length);
+assertEquals(31, ab[pow31]);
+assertEquals(32, ab[2 * pow31 - 1]);
+
+var c = [];
+c[pow30] = 30;
+assertThrows(function() { c.concat(c, a); }, RangeError);