[elements] Fix length bounds precheck for Array.prototype.concat

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 3d176aef8033433615fa428fd6298533ac8bf34b..3ab770c25f26250e2b82cfadb12383f66cc88a33 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -2993,7 +2993,7 @@ Handle<JSArray> ElementsAccessor::Concat(Isolate* isolate, Arguments* args,
 
       // We shouldn't overflow when adding another len.
       const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2);
-      STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt);
+      STATIC_ASSERT(FixedDoubleArray::kMaxLength < kHalfOfMaxInt);

[Igor Sheludko, 2016/04/05 12:53:27]

You could probably also hoist these checks out of the loop as above.

[Camillo Bruni, 2016/04/05 15:07:48]

done

       USE(kHalfOfMaxInt);
       result_len += len;
       DCHECK(0 <= result_len);