fix a missing array limit check

src/org/mozilla/javascript/NativeArray.java

@@ -1607,6 +1607,10 @@ private static long concatSpreadArg(
         long srclen = getLengthProperty(cx, arg);
         long newlen = srclen + offset;
 
+        if (newlen > NativeNumber.MAX_SAFE_INTEGER) {
+            throw ScriptRuntime.typeErrorById("msg.arraylength.too.big", newlen);
+        }
+
         // First, optimize for a pair of native, dense arrays
         if ((newlen <= Integer.MAX_VALUE) && (result instanceof NativeArray)) {
             final NativeArray denseResult = (NativeArray) result;
@@ -1656,7 +1660,14 @@ private static Scriptable js_concat(
         scope = getTopLevelScope(scope);
         final Scriptable result = cx.newArray(scope, 0);
 
-        long length = doConcat(cx, scope, result, o, 0);
+        long length;
+        if (isConcatSpreadable(cx, scope, o)) {
+            length = concatSpreadArg(cx, result, o, 0);
+        } else {
+            defineElem(cx, result, 0, o);
+            length = 1;
+        }
+
         for (Object arg : args) {
             length = doConcat(cx, scope, result, arg, length);
         }

testsrc/org/mozilla/javascript/tests/es6/NativeArray2Test.java

@@ -0,0 +1,68 @@
+package org.mozilla.javascript.tests.es6;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mozilla.javascript.Context;
+import org.mozilla.javascript.ScriptableObject;
+
+/**
+ * @see <a
+ *     href="https://github.com/mozilla/rhino/issues/673">https://github.com/mozilla/rhino/issues/673</a>
+ */
+public class NativeArray2Test {
+
+    private Context cx;
+    private ScriptableObject scope;
+
+    @Before
+    public void setUp() {
+        cx = Context.enter();
+        cx.setLanguageVersion(Context.VERSION_ES6);
+        scope = cx.initStandardObjects();
+    }
+
+    @After
+    public void tearDown() {
+        Context.exit();
+    }
+
+    @Test
+    public void concatLimitSpreadable() {
+        String js =
+                "var spreadable = {};\n"
+                        + "spreadable.length = Number.MAX_SAFE_INTEGER;\n"
+                        + "spreadable[Symbol.isConcatSpreadable] = true;\n"
+                        + "try {\n"
+                        + "  [1].concat(spreadable);\n"
+                        + "} catch(e) {"
+                        + " '' + e;\n"
+                        + "};";
+
+        String result = (String) cx.evaluateString(scope, js, "test", 1, null);
+        assertTrue(result.endsWith("exceeds supported capacity limit."));
+    }
+
+    @Test
+    public void concatLimitSpreadable2() {
+        String js =
+                "var spreadable = {\n"
+                        + "  length: Number.MAX_SAFE_INTEGER,\n"
+                        + "  get 0() {\n"
+                        + "    throw new Error('get failed');\n"
+                        + "  },\n"
+                        + "};\n"
+                        + "spreadable[Symbol.isConcatSpreadable] = true;\n"
+                        + "try {\n"
+                        + "  [].concat(spreadable);\n"
+                        + "} catch(e) {"
+                        + " '' + e;\n"
+                        + "};";
+
+        String result = (String) cx.evaluateString(scope, js, "test", 1, null);
+        assertEquals(result, "Error: get failed", result);
+    }
+}