Correct large packed array length limitation

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 1926eda2776c2bd73182befd9dac4ed553630730..5d22876fbf8dbaabfffe4cea952faea270c827bd 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -14632,11 +14632,11 @@ static MaybeObject* ArrayConstructorCommon(Isolate* isolate,
   if (caller_args->length() == 1) {
     Object* argument_one = (*caller_args)[0];
     if (argument_one->IsSmi()) {
-      int value = Smi::cast(argument_one)->value();
-      if (value < 0 || value >= JSObject::kInitialMaxFastElementArray) {
+      int len = Smi::cast(argument_one)->value();
+      if (len < 0 || len > JSObject::kInitialMaxFastElementArray) {
         // the array is a dictionary in this case.
         can_use_type_feedback = false;
-      } else if (value != 0) {
+      } else if (len != 0) {
         holey = true;
       }
     } else {