Correct large packed array length limitation

test/mjsunit/array-constructor-feedback.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 135 matching lines @@
     }
     a = bar(10);
     a[0] = "a string";
     a = bar(10);
     assertKind(elements_kind.fast, a);
     %OptimizeFunctionOnNextCall(bar);
     a = bar(10);
     assertKind(elements_kind.fast, a);
     assertOptimized(bar);
     // The stub bails out, but the method call should be fine.
-    a = bar(100000);
+    a = bar(100001);
     assertOptimized(bar);
     assertKind(elements_kind.dictionary, a);
 
     // If the argument isn't a smi, it bails out as well
     a = bar("oops");
     assertOptimized(bar);
     assertKind(elements_kind.fast, a);
 
     function barn(one, two, three) {
       return new Array(one, two, three);
@@ skipping 46 matching lines @@
 
     var contextB = Realm.create();
     Realm.eval(contextB, "function bar2() { return new Array(); };");
     Realm.eval(contextB, "bar2(); bar2();");
     Realm.eval(contextB, "%OptimizeFunctionOnNextCall(bar2);");
     Realm.eval(contextB, "bar2();");
     assertFalse(Realm.eval(contextB, "bar2();") instanceof Array);
     assertTrue(Realm.eval(contextB, "bar2() instanceof Array"));
   })();
 }