The ArrayConcat builtin didn't respect @@isConcatSp

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 69c2871650e87b16abea5b6c8abd3f8522247236..ccdec3cfd385c7bc5dfbc61d9187ab94757e4f44 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -944,9 +944,14 @@ BUILTIN(ArrayConcat) {
     bool is_holey = false;
     for (int i = 0; i < n_arguments; i++) {
       Object* arg = args[i];
+      bool fallback = false;
       PrototypeIterator iter(isolate, arg);
+      if (FLAG_harmony_concat_spreadable) {
+        Handle<Object> obj(arg, isolate);
+        fallback = !IsConcatSpreadable(isolate, obj);

[adamk, 2015/08/19 19:50:35]

As the test failures show, you can't make this call here, since there are a
bunch of non-handlified bits of state in local variables which might move if an
allocation occurs.

+      }
       if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements() ||
-          iter.GetCurrent() != array_proto) {
+          iter.GetCurrent() != array_proto || fallback) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "$arrayConcat", args);
       }