- Fixed a bug in the array concat implementation causing the elements in the ...

src/runtime.cc

Index: src/runtime.cc
===================================================================
--- src/runtime.cc	(revision 3537)
+++ src/runtime.cc	(working copy)
@@ -5391,6 +5391,8 @@
     index_offset_ += delta;
   }
 
+  Handle<FixedArray> storage() { return storage_; }
+
  private:
   Handle<FixedArray> storage_;
   uint32_t index_limit_;
@@ -5700,7 +5702,8 @@
   IterateArguments(arguments, &visitor);
 
   result->set_length(*len);
-  result->set_elements(*storage);
+  // Please note the storage might have changed in the visitor.
+  result->set_elements(*visitor.storage());
 
   return *result;
 }