[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 98d61909b806d4d724517aea9226fe3efb5ebcc9..665e44b967afbb481e172b0b6762c5351e7609bc 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1523,7 +1523,6 @@ bool Object::SameValueZero(Object* other) {
 
 MaybeHandle<Object> Object::ArraySpeciesConstructor(
     Isolate* isolate, Handle<Object> original_array) {
-  Handle<Context> native_context = isolate->native_context();
   Handle<Object> default_species = isolate->array_function();
   if (!FLAG_harmony_species) {
     return default_species;
@@ -1548,7 +1547,7 @@ MaybeHandle<Object> Object::ArraySpeciesConstructor(
           isolate, constructor_context,
           JSReceiver::GetFunctionRealm(Handle<JSReceiver>::cast(constructor)),
           Object);
-      if (*constructor_context != *native_context &&
+      if (*constructor_context != *isolate->native_context() &&
           *constructor == constructor_context->array_function()) {
         constructor = isolate->factory()->undefined_value();
       }
@@ -4509,6 +4508,8 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
     JSObject::ValidateElements(receiver);
     return result;
   } else {
+    it->isolate()->UpdateArrayIsConcatSpreadableProtectorOnAddProperty(
+        receiver, it->name());

[Toon Verwaest, 2016/03/31 08:09:46]

This is by far not enough. Reuse dehrenberg's LookupIterator::UpdateProtector to
do the proper invalidation. Just add the new symbol case in there.

     // Migrate to the most up-to-date map that will be able to store |value|
     // under it->name() with |attributes|.
     it->PrepareTransitionToDataProperty(receiver, value, attributes,