Fix handling of this in Array.prototype.concat method.

R=jkummerow@chromium.org
BUG=v8:2080
TEST=test262/15.4.4.4-5-c-i-1

Review URL: https://chromiumcodereview.appspot.com/10095006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/array.js

-// Copyright 2010 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -465,15 +465,19 @@ function ArrayPush() {
 }
 
 
+// Returns an array containing the array elements of the object followed
+// by the array elements of each argument in order. See ECMA-262,
+// section 15.4.4.7.
 function ArrayConcat(arg1) {  // length == 1
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["Array.prototype.concat"]);
   }
 
+  var array = ToObject(this);
   var arg_count = %_ArgumentsLength();
   var arrays = new InternalArray(1 + arg_count);
-  arrays[0] = this;
+  arrays[0] = array;
   for (var i = 0; i < arg_count; i++) {
     arrays[i + 1] = %_Arguments(i);
   }

test/test262/test262.status

@@ -35,7 +35,6 @@ S15.12.2_A1: FAIL
 
 # Not yet analyzed.
 15.10.4.1-5: FAIL
-15.4.4.4-5-c-i-1: FAIL
 
 # V8 Bug: http://code.google.com/p/v8/issues/detail?id=691
 11.2.3-3_3: FAIL