Ensure appropriate bounds checking for Array subclass concat

Ensure appropriate bounds checking for Array subclass concat

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340
Committed: https://crrev.com/ca5deb1ff889cf0ffb48543402f3b930a017aa13
Cr-Commit-Position: refs/heads/master@{#34636}

[Dan Ehrenberg, 2016-03-09 06:37:58]

Description was changed from

==========
Ensure appropriate bounds checking for non-fixed-array concat

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340
==========

to

==========
Ensure appropriate bounds checking for Array subclass concat

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340
==========

[Dan Ehrenberg, 2016-03-09 06:38:03]

The CQ bit was checked by littledan@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-03-09 06:38:05]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1782443002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1782443002/1

[commit-bot: I haz the power, 2016-03-09 07:36:34]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-09 07:36:35]

Dry run: This issue passed the CQ dry run.

[Jakob Kummerow, 2016-03-09 18:39:26]

jkummerow@chromium.org changed reviewers:
+ jkummerow@chromium.org

[Jakob Kummerow, 2016-03-09 18:39:26]

lgtm

[Dan Ehrenberg, 2016-03-09 18:50:28]

The CQ bit was checked by littledan@chromium.org

[commit-bot: I haz the power, 2016-03-09 18:50:31]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1782443002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1782443002/1

[commit-bot: I haz the power, 2016-03-09 18:52:43]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-03-09 18:54:56]

Description was changed from

==========
Ensure appropriate bounds checking for Array subclass concat

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340
==========

to

==========
Ensure appropriate bounds checking for Array subclass concat

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340

Committed: https://crrev.com/ca5deb1ff889cf0ffb48543402f3b930a017aa13
Cr-Commit-Position: refs/heads/master@{#34636}
==========

[commit-bot: I haz the power, 2016-03-09 18:54:56]

Patchset 1 (id:??) landed as
https://crrev.com/ca5deb1ff889cf0ffb48543402f3b930a017aa13
Cr-Commit-Position: refs/heads/master@{#34636}

[Camillo Bruni, 2016-03-10 08:31:20]

lgtm