Use proper ToLength() operation in %ArrayConcat()

src/execution.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_EXECUTION_H_
 #define V8_EXECUTION_H_
 
 #include "src/handles.h"
 
 namespace v8 {
@@ skipping 51 matching lines @@
       Isolate* isolate, Handle<Object> obj);
 
   // ECMA-262 9.5
   MUST_USE_RESULT static MaybeHandle<Object> ToInt32(
       Isolate* isolate, Handle<Object> obj);
 
   // ECMA-262 9.6
   MUST_USE_RESULT static MaybeHandle<Object> ToUint32(
       Isolate* isolate, Handle<Object> obj);
 
+
+  // ES6, draft 10-14-14, section 7.1.15
+  MUST_USE_RESULT static MaybeHandle<Object> ToLength(
+      Isolate* isolate, Handle<Object> obj);
+
   // ECMA-262 9.8
   MUST_USE_RESULT static MaybeHandle<Object> ToString(
       Isolate* isolate, Handle<Object> obj);
 
   // ECMA-262 9.8
   MUST_USE_RESULT static MaybeHandle<Object> ToDetailString(
       Isolate* isolate, Handle<Object> obj);
 
   // ECMA-262 9.9
   MUST_USE_RESULT static MaybeHandle<Object> ToObject(
@@ skipping 187 matching lines @@
   friend class Isolate;
   friend class StackLimitCheck;
   friend class PostponeInterruptsScope;
 
   DISALLOW_COPY_AND_ASSIGN(StackGuard);
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_EXECUTION_H_