Correct large packed array length limitation

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 303 matching lines @@
     return a;
   }
 
   obj = newarraycase_onearg(5, 3.5);
   assertKind(elements_kind.fast_double, obj);
   obj = newarraycase_onearg(10, 5);
   assertKind(elements_kind.fast_double, obj);
   obj = newarraycase_onearg(0, 5);
   assertKind(elements_kind.fast_double, obj);
   // Now pass a length that forces the dictionary path.
-  obj = newarraycase_onearg(100000, 5);
+  obj = newarraycase_onearg(100001, 5);
   assertKind(elements_kind.dictionary, obj);
-  assertTrue(obj.length == 100000);
+  assertTrue(obj.length == 100001);
 
   // Verify that cross context calls work
   var realmA = Realm.current();
   var realmB = Realm.create();
   assertEquals(0, realmA);
   assertEquals(1, realmB);
 
   function instanceof_check(type) {
     assertTrue(new type() instanceof type);
     assertTrue(new type(5) instanceof type);
@@ skipping 36 matching lines @@
   %ClearFunctionTypeFeedback(instanceof_check);
   instanceof_check(Array);
   instanceof_check(Array);
   %OptimizeFunctionOnNextCall(instanceof_check);
   instanceof_check(Array);
   assertOptimized(instanceof_check);
 
   instanceof_check(realmBArray);
   assertUnoptimized(instanceof_check);
 }