Fix off-by-one error in Array.concat slow mode check

BUG=chromium:395499
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/399753005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -9857,8 +9857,8 @@ class ArrayConcatVisitor {
     // but the array blowing the limit didn't contain elements beyond the
     // provided-for index range, go to dictionary mode now.
     if (fast_elements_ &&
-        index_offset_ >= static_cast<uint32_t>(
-            FixedArrayBase::cast(*storage_)->length())) {
+        index_offset_ >
+            static_cast<uint32_t>(FixedArrayBase::cast(*storage_)->length())) {
       SetDictionaryMode();
     }
   }