Fix Array.prototype.concat for arguments object with getter.

Fix Array.prototype.concat for arguments object with getter.

R=adamk@chromium.org
BUG=chromium:516775
LOG=N

Committed: https://crrev.com/2e0d55a5b9a31296956d029896e6d47a8c1605c9
Cr-Commit-Position: refs/heads/master@{#30042}

[adamk, 2015-08-05 18:05:53]

https://codereview.chromium.org/1270403002/diff/1/src/runtime/runtime-array.cc
File src/runtime/runtime-array.cc (right):

https://codereview.chromium.org/1270403002/diff/1/src/runtime/runtime-array.c...
src/runtime/runtime-array.cc:442: // See ES6 22.1.3.1 step 7-a-ii
I think you mean 7-d-ii?

https://codereview.chromium.org/1270403002/diff/1/test/mjsunit/regress/regres...
File test/mjsunit/regress/regress-crbug-516775.js (right):

https://codereview.chromium.org/1270403002/diff/1/test/mjsunit/regress/regres...
test/mjsunit/regress/regress-crbug-516775.js:20: assertThrows(function() {
[].concat(a2); });
As I said over on the bug, I think this behavior is wrong. The spec doesn't walk
the prototype chain explicitly, instead using normal property lookup to read
'length'. And since a1 and a2 are Array instances, they always have a 'length'
instance property that should shadow any on the prototype chain.

[Michael Starzinger, 2015-08-05 19:37:27]

mstarzinger@chromium.org changed reviewers:
+ mstarzinger@chromium.org

[Michael Starzinger, 2015-08-05 19:37:28]

https://codereview.chromium.org/1270403002/diff/1/test/mjsunit/regress/regres...
File test/mjsunit/regress/regress-crbug-516775.js (right):

https://codereview.chromium.org/1270403002/diff/1/test/mjsunit/regress/regres...
test/mjsunit/regress/regress-crbug-516775.js:20: assertThrows(function() {
[].concat(a2); });
On 2015/08/05 18:05:53, adamk wrote:
> As I said over on the bug, I think this behavior is wrong. The spec doesn't
walk
> the prototype chain explicitly, instead using normal property lookup to read
> 'length'. And since a1 and a2 are Array instances, they always have a 'length'
> instance property that should shadow any on the prototype chain.

+1. My understanding of the expected behavior is similar. The only observable
property load before the visitor is called, should be the load of the "length"
from the receiver in {IterateElements} at the top. Anything in
{CollectElementIndices} should be non-observable.

[Yang, 2015-08-06 06:57:32]

Done. Please re-review.

[Michael Starzinger, 2015-08-06 07:38:40]

LGTM.

[Yang, 2015-08-06 10:05:12]

The CQ bit was checked by yangguo@chromium.org

[commit-bot: I haz the power, 2015-08-06 10:05:24]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1270403002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1270403002/40001

[commit-bot: I haz the power, 2015-08-06 10:28:34]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-08-06 10:28:46]

Patchset 3 (id:??) landed as
https://crrev.com/2e0d55a5b9a31296956d029896e6d47a8c1605c9
Cr-Commit-Position: refs/heads/master@{#30042}