Use proper ToLength() operation in %ArrayConcat()

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/runtime/runtime-utils.h"
 
 namespace v8 {
@@ skipping 443 matching lines @@
   uint32_t length = 0;
 
   if (receiver->IsJSArray()) {
     Handle<JSArray> array(Handle<JSArray>::cast(receiver));
     length = static_cast<uint32_t>(array->length()->Number());
   } else {
     Handle<Object> val;
     Handle<Object> key(isolate->heap()->length_string(), isolate);
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
         Runtime::GetObjectProperty(isolate, receiver, key), false);
-    // TODO(caitp): implement ToLength() abstract operation for C++
-    val->ToUint32(&length);
+    // TODO(caitp): Support larger element indexes (up to 2^53-1).
+    if (!val->ToUint32(&length)) {
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
+          Execution::ToLength(isolate, val), false);
+      val->ToUint32(&length);
+    }
   }
 
   switch (receiver->GetElementsKind()) {
     case FAST_SMI_ELEMENTS:
     case FAST_ELEMENTS:
     case FAST_HOLEY_SMI_ELEMENTS:
     case FAST_HOLEY_ELEMENTS: {
       // Run through the elements FixedArray and use HasElement and GetElement
       // to check the prototype for missing elements.
       Handle<FixedArray> elements(FixedArray::cast(receiver->elements()));
@@ skipping 803 matching lines @@
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_FastOneByteArrayJoin) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   return isolate->heap()->undefined_value();
 }
 }
 }  // namespace v8::internal