Fix Array.prototype.concat for arguments object with getter.

test/mjsunit/regress/regress-crbug-516775.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function argument_with_length_getter(f) {
+  arguments.__defineGetter__('length', f);
+  return arguments;
+}
+
+var a1 = [];
+%NormalizeElements(a1);
+a1.__proto__ = argument_with_length_getter(function() { return 'boom' });
+[].concat(a1);
+
+var a2 = [];
+%NormalizeElements(a2);
+a2.__proto__ = argument_with_length_getter(function() { throw 'boom' });
+assertThrows(function() { [].concat(a2); });

[adamk, 2015/08/05 18:05:53]

As I said over on the bug, I think this behavior is wrong. The spec doesn't walk
the prototype chain explicitly, instead using normal property lookup to read
'length'. And since a1 and a2 are Array instances, they always have a 'length'
instance property that should shadow any on the prototype chain.

[Michael Starzinger, 2015/08/05 19:37:28]

+1. My understanding of the expected behavior is similar. The only observable
property load before the visitor is called, should be the load of the "length"
from the receiver in {IterateElements} at the top. Anything in
{CollectElementIndices} should be non-observable.