Array.concat: properly go to dictionary mode when required

test/mjsunit/regress/regress-crbug-387031.js

Index: test/mjsunit/regress/regress-crbug-387031.js
diff --git a/test/mjsunit/regress/regress-349885.js b/test/mjsunit/regress/regress-crbug-387031.js
similarity index 55%
copy from test/mjsunit/regress/regress-349885.js
copy to test/mjsunit/regress/regress-crbug-387031.js
index dd3e79526041b0362434608b81429d83e18ae8ef..77f52a9d35ea296d164def9de6f859bcbceb527a 100644
--- a/test/mjsunit/regress/regress-349885.js
+++ b/test/mjsunit/regress/regress-crbug-387031.js
@@ -4,12 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
-// The bug 349885
-
-function foo(a) {
-  a[292755462] = new Object();
+a = [1];
+b = [];
+a.__defineGetter__(0, function () {
+  b.length = 0xffffffff;
+});
+c = a.concat(b);
+for (var i = 0; i < 20; i++) {
+  assertEquals(undefined, (c[i]));
 }
-foo(new Array(5));
-foo(new Array(5));
-%OptimizeFunctionOnNextCall(foo);
-foo(new Array(10));