[INFER] Handle non-array arguments to Array.concat, bug 617750.

js/src/jit-test/tests/basic/testArrayConcat.js

@@ -5,3 +5,6 @@ x[1] = 2;
 x[2] = 3;
 var y = x.concat();
 assertEq(y[3], undefined);
+
+var z = x.concat(/abc/).pop();
+assertEq(x.source, "abc");

js/src/jsarray.cpp

@@ -2595,6 +2595,12 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
             }
         }
 
+        /*
+         * The type handler for Array.concat only handles array arguments.
+         * Inform type inference of any non-array arguments passed in.
+         */
+        cx->addTypePropertyId(ntype, JSID_VOID, v);
+
         if (!SetArrayElement(cx, nobj, length, v))
             return false;
         length++;