Correct large packed array length limitation

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1960 matching lines @@
 MUST_USE_RESULT MaybeObject* ArrayConstructInitializeElements(
     JSArray* array, Arguments* args) {
   Heap* heap = array->GetIsolate()->heap();
 
   // Optimize the case where there is one argument and the argument is a
   // small smi.
   if (args->length() == 1) {
     Object* obj = (*args)[0];
     if (obj->IsSmi()) {
       int len = Smi::cast(obj)->value();
-      if (len > 0 && len < JSObject::kInitialMaxFastElementArray) {
+      if (len > 0 && len <= JSObject::kInitialMaxFastElementArray) {
         ElementsKind elements_kind = array->GetElementsKind();
         MaybeObject* maybe_array = array->Initialize(len, len);
         if (maybe_array->IsFailure()) return maybe_array;
 
         if (!IsFastHoleyElementsKind(elements_kind)) {
           elements_kind = GetHoleyElementsKind(elements_kind);
           maybe_array = array->TransitionElementsKind(elements_kind);
           if (maybe_array->IsFailure()) return maybe_array;
         }
 
@@ skipping 66 matching lines @@
       UNREACHABLE();
       break;
   }
 
   array->set_elements(elms);
   array->set_length(Smi::FromInt(number_of_elements));
   return array;
 }
 
 } }  // namespace v8::internal