Fix array concat to follow the specification in the presence of element getters.

src/handles.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 21 matching lines @@
 
 namespace v8 {
 namespace internal {
 
 // ----------------------------------------------------------------------------
 // A Handle provides a reference to an object that survives relocation by
 // the garbage collector.
 // Handles are only valid within a HandleScope.
 // When a handle is created for an object a cell is allocated in the heap.
 
-template<class T>
+template<typename T>
 class Handle {
  public:
   INLINE(explicit Handle(T** location)) { location_ = location; }
   INLINE(explicit Handle(T* obj));
 
   INLINE(Handle()) : location_(NULL) {}
 
   // Constructor for handling automatic up casting.
   // Ex. Handle<JSFunction> can be passed when Handle<Object> is expected.
   template <class S> Handle(Handle<S> handle) {
@@ skipping 33 matching lines @@
 
   // Closes the given scope, but lets this handle escape. See
   // implementation in api.h.
   inline Handle<T> EscapeFrom(v8::HandleScope* scope);
 
  private:
   T** location_;
 };
 
 
+// A handle-scope based variable. The value stored in the variable can change
+// over time. The value stored in the variable at any time is a root
+// for garbage collection.
+// The variable is backed by the current HandleScope.
+template <typename T>
+class HandleCell {
+ public:
+  // Create a new HandleCell holding the given value.
+  explicit HandleCell(Handle<T> value);
+  explicit HandleCell(T* value);
+
+  // Create an alias of an existing HandleCell.
+  explicit HandleCell(const HandleCell<T>& value)
+      : location_(value.location_) { }
+
+  INLINE(T* operator->() const) { return operator*(); }
+  INLINE(T* operator*() const) {
+    return *location_;
+  }
+  INLINE(void operator=(T* value)) {
+    *location_ = value;
+  }
+  INLINE(void operator=(Handle<T> value)) {
+    *location_ = *value;
+  }
+  INLINE(void operator=(const HandleCell<T>& value)) {
+    *location_ = *value.location_;
+  }
+
+  // Extract the value of the variable and cast it to a give type.
+  // This is typically used for calling methods on a more specialized type.
+  template <typename S>
+  inline S* cast() {
+    S::cast(*location_);
+    return *reinterpret_cast<S**>(location_);
+  }
+
+  Handle<T> ToHandle() const {
+    return Handle<T>(*location_);
+  }
+
+ private:
+  // Prevent implicit constructor from being created.
+  HandleCell();
+
+  T** location_;
+};
+
+
 // A stack-allocated class that governs a number of local handles.
 // After a handle scope has been created, all local handles will be
 // allocated within that handle scope until either the handle scope is
 // deleted or another handle scope is created.  If there is already a
 // handle scope and a new one is created, all allocations will take
 // place in the new handle scope until it is deleted.  After that,
 // new handles will again be allocated in the original handle scope.
 //
 // After the handle scope of a local handle has been deleted the
 // garbage collector will no longer track the object stored in the
@@ skipping 278 matching lines @@
  private:
   bool has_been_transformed_;  // Tells whether the object has been transformed.
   int unused_property_fields_;  // Captures the unused number of field.
   Handle<JSObject> object_;    // The object being optimized.
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_HANDLES_H_