MIPS: Fix function Fast_ArrayConcat.

Port for https://codereview.chromium.org/1409123003

In function Fast_ArrayConcat is added comparation between result_len and
FixedDoubleArray::kMaxLength. This change enables successful execution
of the test regress-599414-array-concat-fast-path.

Original commit message:
  [runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

  Currently we do not check for @@isConcatSpreadable properly. If the Symbol is
  set on the Array.prototype or Object.prototype the current fast paths fail.
  This CL adds a fix to globally invalidate a isConcatSpreadable_protector.

  Drive-by-fix: use named accessors for context variables

TEST=mjsunit/regress/regress-599414-array-concat-fast-path
BUG=

Review-Url: https://codereview.chromium.org/1995313002
Cr-Commit-Position: refs/heads/master@{#36429}

src/builtins.cc

@@ -1467,7 +1467,8 @@ MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) {
       result_len += Smi::cast(array->length())->value();
       DCHECK(result_len >= 0);
       // Throw an Error if we overflow the FixedArray limits
-      if (FixedArray::kMaxLength < result_len) {
+      if (FixedDoubleArray::kMaxLength < result_len ||
+          FixedArray::kMaxLength < result_len) {
         AllowHeapAllocation gc;
         THROW_NEW_ERROR(isolate,
                         NewRangeError(MessageTemplate::kInvalidArrayLength),