[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 1ed2fd125315eea8ca4af113cab5a668ad25cb3c..cd64000f3a762bd6cd9c955bc2d334bac51bfec3 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1172,16 +1172,6 @@ bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
 }
 
 
-bool HasConcatSpreadableModifier(Isolate* isolate, Handle<JSArray> obj) {
-  if (!FLAG_harmony_concat_spreadable) return false;
-  Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
-  Maybe<bool> maybe =
-      JSReceiver::HasProperty(Handle<JSReceiver>::cast(obj), key);
-  if (!maybe.IsJust()) return false;
-  return maybe.FromJust();
-}
-
-
 bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
   HandleScope handle_scope(isolate);
   if (!obj->IsSpecObject()) return false;
@@ -1380,10 +1370,23 @@ Object* Slow_ArrayConcat(Arguments* args, Isolate* isolate) {
 }
 
 
+bool FastArrayIsConcatSpreadable(Isolate* isolate, Handle<JSArray> obj) {
+  if (!FLAG_harmony_concat_spreadable) return true;
+  int nof = obj->map()->NumberOfOwnDescriptors();
+  // If there is only the 'length' property we are fine.
+  if (nof == 1) return true;
+  // In the other case do a full property lookup of @@isConcatSpreadable.
+  return IsConcatSpreadable(isolate, obj);
+}
+
+
 MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) {
+  // TODO(cbruni): check for @@isConcatSpreadable set on the array/object
+  // prototype
   if (!isolate->IsFastArrayConstructorPrototypeChainIntact()) {
     return MaybeHandle<JSArray>();
   }
+  if (isolate->IsArrayIsConcatSpreadableSet()) return MaybeHandle<JSArray>();
   int n_arguments = args->length();
   int result_len = 0;
   {
@@ -1398,7 +1401,8 @@ MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) {
       if (!array->HasFastElements()) return MaybeHandle<JSArray>();
       PrototypeIterator iter(isolate, arg);
       if (iter.GetCurrent() != array_proto) return MaybeHandle<JSArray>();
-      if (HasConcatSpreadableModifier(isolate, array)) {
+      bool is_concat_spreadable = FastArrayIsConcatSpreadable(isolate, array);
+      if (!is_concat_spreadable || isolate->has_pending_exception()) {
         return MaybeHandle<JSArray>();
       }
       int len = Smi::cast(array->length())->value();