Fix array concat to follow the specification in the presence of element getters.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 24887a0efb6adba9fc902b813879b695997b7fb9..f955d334d20b7403826a3c877d091ea01d9ab955 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -769,6 +769,10 @@ bool Object::HasSpecificClassOf(String* name) {
 
 
 MaybeObject* Object::GetElement(uint32_t index) {
+  // GetElement can trigger a getter which can cause allocation.
+  // This was not always the case. This ASSERT is here to catch
+  // leftover incorrect uses.
+  ASSERT(Heap::IsAllocationAllowed());
   return GetElementWithReceiver(this, index);
 }