Correct large packed array length limitation

test/mjsunit/array-feedback.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 101 matching lines @@
     create1(0);
     create1(0);
     a = create1(0);
     assertFalse(isHoley(a));
     assertKind(elements_kind.fast_smi_only, a);
     a[0] = "hello";
     b = create1(10);
     assertTrue(isHoley(b));
     assertKind(elements_kind.fast, b);
 
-    a = create1(100000);
+    a = create1(100001);
     assertKind(elements_kind.dictionary, a);
 
     function create3(arg1, arg2, arg3) {
       return Array(arg1, arg2, arg3);
     }
 
     create3();
     create3();
     a = create3(1,2,3);
     a[0] = 3.5;
@@ skipping 79 matching lines @@
 
     var realmBArray = Realm.eval(realmB, "Array");
     instanceof_check(Array);
     instanceof_check(Array);
     instanceof_check(Array);
     instanceof_check(realmBArray);
     instanceof_check(realmBArray);
     instanceof_check(realmBArray);
   })();
 }