[es6] Spread in array literals

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug.h"
 #include "src/messages.h"
@@ skipping 703 matching lines @@
   key->ToArrayIndex(&index);
 
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result, JSObject::SetElement(object, index, value, attrs, SLOPPY,
                                             false, DEFINE_PROPERTY));
   return *result;
 }
 
 
+RUNTIME_FUNCTION(Runtime_AppendElement) {
+  HandleScope scope(isolate);
+  RUNTIME_ASSERT(args.length() == 2);
+
+  CONVERT_ARG_HANDLE_CHECKED(JSArray, array, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
+
+  int index = Smi::cast(array->length())->value();
+
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, result, JSObject::SetElement(array, index, value, NONE, SLOPPY,
+                                            false, DEFINE_PROPERTY));
+  return *array;
+}
+
+
 RUNTIME_FUNCTION(Runtime_DeleteProperty) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 3);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Name, key, 1);
   CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode, 2);
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result, JSReceiver::DeleteProperty(object, key, language_mode));
   return *result;
@@ skipping 827 matching lines @@
   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 
   RETURN_FAILURE_ON_EXCEPTION(
       isolate,
       JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
                                setter, attrs));
   return isolate->heap()->undefined_value();
 }
 }  // namespace internal
 }  // namespace v8