Index: src/builtins.cc |
diff --git a/src/builtins.cc b/src/builtins.cc |
index d869fd0961b1413f4843f4cb8c0787dbb419fb45..7f9652c9cdad14c569f5b46d41a36f337636f256 100644 |
--- a/src/builtins.cc |
+++ b/src/builtins.cc |
@@ -1471,7 +1471,8 @@ MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) { |
result_len += Smi::cast(array->length())->value(); |
DCHECK(result_len >= 0); |
// Throw an Error if we overflow the FixedArray limits |
- if (FixedArray::kMaxLength < result_len) { |
+ if (FixedDoubleArray::kMaxLength < result_len || |
+ FixedArray::kMaxLength < result_len) { |
AllowHeapAllocation gc; |
THROW_NEW_ERROR(isolate, |
NewRangeError(MessageTemplate::kInvalidArrayLength), |