[elements] Fix length bounds precheck for Array.prototype.concat

test/mjsunit/regress/regress-599414-array-concat-fast-path.js

Index: test/mjsunit/regress/regress-599414-array-concat-fast-path.js
diff --git a/test/message/regress/regress-4829-1.js b/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
similarity index 52%
copy from test/message/regress/regress-4829-1.js
copy to test/mjsunit/regress/regress-599414-array-concat-fast-path.js
index 1ad5feda8cb96cd24e4c47f7407c9699d150c327..3819233f99b2851176f54641e2a445d705f561e7 100644
--- a/test/message/regress/regress-4829-1.js
+++ b/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
@@ -2,6 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function tag() {}
+var largeArray = 'x'.repeat(999).split('');
+var a = largeArray;
 
-tag(tag`\xyy`);
+assertThrows(() => {
+  for (;;) {
+    a = a.concat(a, a, a, a, a, a);
+  }}, RangeError);