- Fixed a bug in the array concat implementation causing the elements in the result to be lost.

Review URL: http://codereview.chromium.org/523055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3538 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -6886,7 +6886,7 @@ Object* HashTable<Shape, Key>::EnsureCapacity(int n, Key key) {
   //   50% is still free after adding n elements and
   //   at most 50% of the free elements are deleted elements.
   if ((nof + (nof >> 1) <= capacity) &&
-      (nod <= (capacity - nof) >> 1) ) return this;
+      (nod <= (capacity - nof) >> 1)) return this;
 
   Object* obj = Allocate(nof * 2);
   if (obj->IsFailure()) return obj;

src/runtime.cc

@@ -5391,6 +5391,8 @@ class ArrayConcatVisitor {
     index_offset_ += delta;
   }
 
+  Handle<FixedArray> storage() { return storage_; }
+
  private:
   Handle<FixedArray> storage_;
   uint32_t index_limit_;
@@ -5700,7 +5702,8 @@ static Object* Runtime_ArrayConcat(Arguments args) {
   IterateArguments(arguments, &visitor);
 
   result->set_length(*len);
-  result->set_elements(*storage);
+  // Please note the storage might have changed in the visitor.
+  result->set_elements(*visitor.storage());
 
   return *result;
 }