The ArrayConcat builtin didn't respect @@isConcatSp

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/api.h"
 #include "src/api-natives.h"
 #include "src/arguments.h"
 #include "src/base/once.h"
@@ skipping 926 matching lines @@
     if (!ArrayPrototypeHasNoElements(&iter)) {
       AllowHeapAllocation allow_allocation;
       return CallJsBuiltin(isolate, "$arrayConcat", args);
     }
 
     // Iterate through all the arguments performing checks
     // and calculating total length.
     bool is_holey = false;
     for (int i = 0; i < n_arguments; i++) {
       Object* arg = args[i];
+      bool fallback = false;
       PrototypeIterator iter(isolate, arg);
+      if (FLAG_harmony_concat_spreadable) {
+        Handle<Object> obj(arg, isolate);
+        fallback = !IsConcatSpreadable(isolate, obj);

[adamk, 2015/08/19 19:50:35]

As the test failures show, you can't make this call here, since there are a
bunch of non-handlified bits of state in local variables which might move if an
allocation occurs.

+      }
       if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements() ||
-          iter.GetCurrent() != array_proto) {
+          iter.GetCurrent() != array_proto || fallback) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "$arrayConcat", args);
       }
       int len = Smi::cast(JSArray::cast(arg)->length())->value();
 
       // We shouldn't overflow when adding another len.
       const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2);
       STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt);
       USE(kHalfOfMaxInt);
       result_len += len;
@@ skipping 655 matching lines @@
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 }  // namespace internal
 }  // namespace v8