[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index 8f4915cefd55bbab5f0f19b70a41ad7a08a8e734..338081f98fc1645bbf0de43f49dbee61c201124e 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -960,9 +960,19 @@ class Isolate {
   Map* get_initial_js_array_map(ElementsKind kind,
                                 Strength strength = Strength::WEAK);
 
-  static const int kArrayProtectorValid = 1;
-  static const int kArrayProtectorInvalid = 0;
-
+  // The isConcatSpreadable protector is valid if there this property is

[Toon Verwaest, 2015/11/02 12:32:45]

valid if @@isConcatSpreadable is not present on ...

+  // not present on the Array prototype chain.
+  static const int kArrayIsConcatSpreadableProtectorValid = 1;
+  static const int kArrayIsConcatSpreadableProtectorInvalid = 0;
+  bool IsArrayIsConcatSpreadableSet();
+
+  void UpdateArrayIsConcatSpreadableProtectorOnAddProperty(
+      Handle<JSObject> object, Handle<Name> name);
+
+  // The elements protector is valid if there are not additional elements

[Toon Verwaest, 2015/11/02 12:32:45]

not -> no

+  // on the Array prototype chain.
+  static const int kArrayElementsProtectorValid = 1;
+  static const int kArrayElementsProtectorInvalid = 0;
   bool IsFastArrayConstructorPrototypeChainIntact();
 
   // On intent to set an element in object, make sure that appropriate
@@ -1094,6 +1104,7 @@ class Isolate {
 
  protected:
   explicit Isolate(bool enable_serializer);
+  Context* ContextForArrayOrObjectPrototype(Handle<JSObject> object);
 
  private:
   friend struct GlobalState;