[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/isolate.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ISOLATE_H_
 #define V8_ISOLATE_H_
 
 #include <queue>
 #include <set>
 
@@ skipping 673 matching lines @@
 
   // Returns if the given context may access the given global object. If
   // the result is false, the pending exception is guaranteed to be
   // set.
   bool MayAccess(Handle<Context> accessing_context, Handle<JSObject> receiver);
 
   void SetFailedAccessCheckCallback(v8::FailedAccessCheckCallback callback);
   void ReportFailedAccessCheck(Handle<JSObject> receiver);
 
   // Exception throwing support. The caller should use the result
-  // of Throw() as its return value.
+  // of Throw() as its return vaue.
   Object* Throw(Object* exception, MessageLocation* location = NULL);
   Object* ThrowIllegalOperation();
 
   template <typename T>
   MUST_USE_RESULT MaybeHandle<T> Throw(Handle<Object> exception,
                                        MessageLocation* location = NULL) {
     Throw(*exception, location);
     return MaybeHandle<T>();
   }
 
@@ skipping 247 matching lines @@
     date_cache_ = date_cache;
   }
 
   Map* get_initial_js_array_map(ElementsKind kind);
 
   static const int kArrayProtectorValid = 1;
   static const int kArrayProtectorInvalid = 0;
 
   bool IsFastArrayConstructorPrototypeChainIntact();
   inline bool IsArraySpeciesLookupChainIntact();
+  bool IsIsConcatSpreadableLookupChainIntact();
 
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
   // object prototype. Also ensure that changes to prototype chain between
   // Array and Object fire notifications.
   void UpdateArrayProtectorOnSetElement(Handle<JSObject> object);
   void UpdateArrayProtectorOnSetLength(Handle<JSObject> object) {
     UpdateArrayProtectorOnSetElement(object);
   }
   void UpdateArrayProtectorOnSetPrototype(Handle<JSObject> object) {
     UpdateArrayProtectorOnSetElement(object);
   }
   void UpdateArrayProtectorOnNormalizeElements(Handle<JSObject> object) {
     UpdateArrayProtectorOnSetElement(object);
   }
   void InvalidateArraySpeciesProtector();
+  void InvalidateIsConcatSpreadableProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
 
   CallInterfaceDescriptorData* call_descriptor_data(int index);
 
   void IterateDeferredHandles(ObjectVisitor* visitor);
   void LinkDeferredHandles(DeferredHandles* deferred_handles);
   void UnlinkDeferredHandles(DeferredHandles* deferred_handles);
 
@@ skipping 112 matching lines @@
   FutexWaitListNode* futex_wait_list_node() { return &futex_wait_list_node_; }
 
   CancelableTaskManager* cancelable_task_manager() {
     return cancelable_task_manager_;
   }
 
   interpreter::Interpreter* interpreter() const { return interpreter_; }
 
   base::AccountingAllocator* allocator() { return &allocator_; }
 
+  bool IsInAnyContext(Object* object, uint32_t index);
+
  protected:
   explicit Isolate(bool enable_serializer);
+  bool IsArrayOrObjectPrototype(Object* object);
 
  private:
   friend struct GlobalState;
   friend struct InitializeGlobalState;
   Handle<JSObject> SetUpSubregistry(Handle<JSObject> registry, Handle<Map> map,
                                     const char* name);
 
   // These fields are accessed through the API, offsets must be kept in sync
   // with v8::internal::Internals (in include/v8.h) constants. This is also
   // verified in Isolate::Init() using runtime checks.
@@ skipping 467 matching lines @@
 
   EmbeddedVector<char, 128> filename_;
   FILE* file_;
   int scope_depth_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_ISOLATE_H_