Use FixedArray::kMaxLength instead of incorrect FixedArray::kMaxSize.

src/builtins.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 734 matching lines @@
     return CallJsBuiltin("ArrayConcat", args);
   }
 
   JSArray* receiver_array = JSArray::cast(receiver_obj);
   ASSERT(receiver_array->HasFastElements());
   JSArray* arg_array = JSArray::cast(arg_obj);
   ASSERT(arg_array->HasFastElements());
 
   int receiver_len = Smi::cast(receiver_array->length())->value();
   int arg_len = Smi::cast(arg_array->length())->value();
+  // FixedArrays lengths are limited by FixedArray::kMaxLength thus
+  // we should fit into a smi.
   ASSERT(receiver_len <= (Smi::kMaxValue - arg_len));
 
   int result_len = receiver_len + arg_len;
-  if (result_len > FixedArray::kMaxSize) {
+  if (result_len > FixedArray::kMaxLength) {
     return CallJsBuiltin("ArrayConcat", args);
   }
   if (result_len == 0) {
     return AllocateEmptyJSArray();
   }
 
   // Allocate result.
   Object* result = AllocateJSArray();
   if (result->IsFailure()) return result;
   JSArray* result_array = JSArray::cast(result);
@@ skipping 658 matching lines @@
       if (entry->contains(pc)) {
         return names_[i];
       }
     }
   }
   return NULL;
 }
 
 
 } }  // namespace v8::internal