[INFER] Handle non-array arguments to Array.concat, bug 617750.

js/src/jsarray.cpp

@@ -2595,6 +2595,12 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
             }
         }
 
+        /*
+         * The type handler for Array.concat only handles array arguments.
+         * Inform type inference of any non-array arguments passed in.
+         */
+        cx->addTypePropertyId(ntype, JSID_VOID, v);
+
         if (!SetArrayElement(cx, nobj, length, v))
             return false;
         length++;