[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index a91ec93187def11a2f18a31f86e9f0ef893e3e4d..026db34e348e656a546412eae00da1395e8a34a5 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -968,11 +968,13 @@ class Isolate {
 
   Map* get_initial_js_array_map(ElementsKind kind);
 
+  // The elements protector is valid if there are no additional elements
+  // on the Array prototype chain.
   static const int kArrayProtectorValid = 1;
   static const int kArrayProtectorInvalid = 0;
-
   bool IsFastArrayConstructorPrototypeChainIntact();
   bool IsArraySpeciesLookupChainIntact();
+  bool IsArrayIsConcatSpreadableLookupChainIntact();
 
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
@@ -989,6 +991,7 @@ class Isolate {
     UpdateArrayProtectorOnSetElement(object);
   }
   void InvalidateArraySpeciesProtector();
+  void InvalidateArrayIsConcatSpreadableProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
@@ -1118,8 +1121,11 @@ class Isolate {
 
   interpreter::Interpreter* interpreter() const { return interpreter_; }
 
+  bool IsInContextIndex(Object* object, uint32_t index);
+
  protected:
   explicit Isolate(bool enable_serializer);
+  bool ArrayOrObjectPrototypeIsInContext(Object* object);
 
  private:
   friend struct GlobalState;