Use proper ToLength() operation in %ArrayConcat()

src/execution.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/execution.h"
 
 #include "src/bootstrapper.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/isolate-inl.h"
@@ skipping 527 matching lines @@
   RETURN_NATIVE_CALL(to_uint32, { obj });
 }
 
 
 MaybeHandle<Object> Execution::ToInt32(
     Isolate* isolate, Handle<Object> obj) {
   RETURN_NATIVE_CALL(to_int32, { obj });
 }
 
 
+MaybeHandle<Object> Execution::ToLength(
+    Isolate* isolate, Handle<Object> obj) {
+  RETURN_NATIVE_CALL(to_length, { obj });
+}
+
+
 MaybeHandle<Object> Execution::NewDate(Isolate* isolate, double time) {
   Handle<Object> time_obj = isolate->factory()->NewNumber(time);
   RETURN_NATIVE_CALL(create_date, { time_obj });
 }
 
 
 #undef RETURN_NATIVE_CALL
 
 
 MaybeHandle<JSRegExp> Execution::NewJSRegExp(Handle<String> pattern,
@@ skipping 154 matching lines @@
   }
 
   isolate_->counters()->stack_interrupts()->Increment();
   isolate_->counters()->runtime_profiler_ticks()->Increment();
   isolate_->runtime_profiler()->OptimizeNow();
 
   return isolate_->heap()->undefined_value();
 }
 
 } }  // namespace v8::internal