The ArrayConcat builtin didn't respect @@isConcatSp

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/elements.h"
 #include "src/messages.h"
@@ skipping 1928 matching lines @@
 void ElementsAccessor::TearDown() {
   if (elements_accessors_ == NULL) return;
 #define ACCESSOR_DELETE(Class, Kind, Store) delete elements_accessors_[Kind];
   ELEMENTS_LIST(ACCESSOR_DELETE)
 #undef ACCESSOR_DELETE
   elements_accessors_ = NULL;
 }
 
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
+
+
+bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
+  HandleScope handle_scope(isolate);
+  if (!obj->IsSpecObject()) return false;
+  if (FLAG_harmony_concat_spreadable) {
+    Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
+    Handle<Object> value;
+    MaybeHandle<Object> maybeValue =
+        i::Runtime::GetObjectProperty(isolate, obj, key);
+    if (maybeValue.ToHandle(&value)) {
+      if (!value->IsUndefined()) {
+        return value->BooleanValue();
+      }
+    }
+  }
+  return obj->IsJSArray();
+}
 }  // namespace internal
 }  // namespace v8