[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins.h"
 
 #include "src/api.h"
 #include "src/api-natives.h"
 #include "src/arguments.h"
 #include "src/base/once.h"
@@ skipping 1154 matching lines @@
         visitor->visit(index, element);
       }
       break;
     }
   }
   visitor->increase_index_offset(length);
   return true;
 }
 
 
-bool HasConcatSpreadableModifier(Isolate* isolate, Handle<JSArray> obj) {
-  if (!FLAG_harmony_concat_spreadable) return false;
-  Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
-  Maybe<bool> maybe =
-      JSReceiver::HasProperty(Handle<JSReceiver>::cast(obj), key);
-  if (!maybe.IsJust()) return false;
-  return maybe.FromJust();
-}
-
-
 bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
   HandleScope handle_scope(isolate);
   if (!obj->IsSpecObject()) return false;
   if (FLAG_harmony_concat_spreadable) {
     Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
     Handle<Object> value;
     MaybeHandle<Object> maybeValue =
         i::Runtime::GetObjectProperty(isolate, obj, key);
     if (maybeValue.ToHandle(&value) && !value->IsUndefined()) {
       return value->BooleanValue();
@@ skipping 178 matching lines @@
   }
 
   if (visitor.exceeds_array_limit()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewRangeError(MessageTemplate::kInvalidArrayLength));
   }
   return *visitor.ToArray();
 }
 
 
+bool FastArrayIsConcatSpreadable(Isolate* isolate, Handle<JSArray> obj) {
+  if (!FLAG_harmony_concat_spreadable) return true;
+  int nof = obj->map()->NumberOfOwnDescriptors();
+  // If there is only the 'length' property we are fine.
+  if (nof == 1) return true;
+  // In the other case do a full property lookup of @@isConcatSpreadable.
+  return IsConcatSpreadable(isolate, obj);
+}
+
+
 MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) {
+  // TODO(cbruni): check for @@isConcatSpreadable set on the array/object
+  // prototype
   if (!isolate->IsFastArrayConstructorPrototypeChainIntact()) {
     return MaybeHandle<JSArray>();
   }
+  if (isolate->IsArrayIsConcatSpreadableSet()) return MaybeHandle<JSArray>();
   int n_arguments = args->length();
   int result_len = 0;
   {
     DisallowHeapAllocation no_gc;
     Object* array_proto = isolate->array_function()->prototype();
     // Iterate through all the arguments performing checks
     // and calculating total length.
     for (int i = 0; i < n_arguments; i++) {
       Object* arg = (*args)[i];
       if (!arg->IsJSArray()) return MaybeHandle<JSArray>();
       Handle<JSArray> array(JSArray::cast(arg), isolate);
       if (!array->HasFastElements()) return MaybeHandle<JSArray>();
       PrototypeIterator iter(isolate, arg);
       if (iter.GetCurrent() != array_proto) return MaybeHandle<JSArray>();
-      if (HasConcatSpreadableModifier(isolate, array)) {
+      bool is_concat_spreadable = FastArrayIsConcatSpreadable(isolate, array);
+      if (!is_concat_spreadable || isolate->has_pending_exception()) {
         return MaybeHandle<JSArray>();
       }
       int len = Smi::cast(array->length())->value();
 
       // We shouldn't overflow when adding another len.
       const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2);
       STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt);
       USE(kHalfOfMaxInt);
       result_len += len;
       DCHECK(result_len >= 0);
@@ skipping 853 matching lines @@
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 }  // namespace internal
 }  // namespace v8