| Index: src/builtins.cc
|
| diff --git a/src/builtins.cc b/src/builtins.cc
|
| index d869fd0961b1413f4843f4cb8c0787dbb419fb45..7f9652c9cdad14c569f5b46d41a36f337636f256 100644
|
| --- a/src/builtins.cc
|
| +++ b/src/builtins.cc
|
| @@ -1471,7 +1471,8 @@ MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) {
|
| result_len += Smi::cast(array->length())->value();
|
| DCHECK(result_len >= 0);
|
| // Throw an Error if we overflow the FixedArray limits
|
| - if (FixedArray::kMaxLength < result_len) {
|
| + if (FixedDoubleArray::kMaxLength < result_len ||
|
| + FixedArray::kMaxLength < result_len) {
|
| AllowHeapAllocation gc;
|
| THROW_NEW_ERROR(isolate,
|
| NewRangeError(MessageTemplate::kInvalidArrayLength),
|
|
|