[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index 1ebaa28a76022352a799019e89d1cf2eed0498d1..766d8600480e7f639c07ab231f26381ce77e1ca9 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -968,9 +968,18 @@ class Isolate {
 
   Map* get_initial_js_array_map(ElementsKind kind);
 
+  // Valid if @@isConcatSpreadable is not present on the Array prototype. chain.
+  static const int kArrayIsConcatSpreadableProtectorValid = 1;
+  static const int kArrayIsConcatSpreadableProtectorInvalid = 0;
+  bool IsArrayIsConcatSpreadableSet();
+
+  void UpdateArrayIsConcatSpreadableProtectorOnAddProperty(
+      Handle<JSObject> object, Handle<Name> name);
+
+  // The elements protector is valid if there are no additional elements
+  // on the Array prototype chain.
   static const int kArrayProtectorValid = 1;
   static const int kArrayProtectorInvalid = 0;
-
   bool IsFastArrayConstructorPrototypeChainIntact();
   bool IsArraySpeciesLookupChainIntact();
 
@@ -1122,6 +1131,7 @@ class Isolate {
 
  protected:
   explicit Isolate(bool enable_serializer);
+  Context* ContextForArrayOrObjectPrototype(Handle<JSObject> object);
 
  private:
   friend struct GlobalState;