[runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 433dda7d6f98daa1aac991c04413c4d3d4501bc8..38caee645b2e8d37390daa4cde9c08f3cefdb3e3 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3569,15 +3569,6 @@ Maybe<bool> JSObject::SetPropertyWithInterceptor(LookupIterator* it,
 }
 
 
-MaybeHandle<Object> Object::SetProperty(Handle<Object> object,
-                                        Handle<Name> name, Handle<Object> value,
-                                        LanguageMode language_mode,
-                                        StoreFromKeyed store_mode) {
-  LookupIterator it(object, name);
-  return SetProperty(&it, value, language_mode, store_mode);
-}
-
-
 Maybe<bool> Object::SetPropertyInternal(
     LookupIterator* it, Handle<Object> value, LanguageMode language_mode,
     ShouldThrow should_throw, StoreFromKeyed store_mode, bool* found) {
@@ -3685,6 +3676,15 @@ Maybe<bool> Object::SetPropertyInternal(
 }
 
 
+MaybeHandle<Object> Object::SetProperty(Handle<Object> object,
+                                        Handle<Name> name, Handle<Object> value,
+                                        LanguageMode language_mode,
+                                        StoreFromKeyed store_mode) {
+  LookupIterator it(object, name);
+  return SetProperty(&it, value, language_mode, store_mode);
+}
+
+
 MaybeHandle<Object> Object::SetProperty(LookupIterator* it,
                                         Handle<Object> value,
                                         LanguageMode language_mode,
@@ -3904,6 +3904,9 @@ Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value,
     }
   }
 
+  //  it->isolate()->UpdateArrayIsConcatSpreadableProtectorOnAddProperty(
+  //     receiver, it->GetName());

[Toon Verwaest, 2015/11/02 12:32:46]

stray change?

[Camillo Bruni, 2015/11/03 14:49:25]

indeed.

+
   // Possibly migrate to the most up-to-date map that will be able to store
   // |value| under it->name().
   it->PrepareForDataProperty(to_assign);
@@ -4036,6 +4039,8 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
     JSObject::ValidateElements(receiver);
     return result;
   } else {
+    it->isolate()->UpdateArrayIsConcatSpreadableProtectorOnAddProperty(

[Toon Verwaest, 2015/11/02 12:32:45]

I don't think all stores go through here. Generic keyed stores to dictionary
mode receivers probably don't.

[Camillo Bruni, 2015/11/03 14:49:25]

I added another test case, if I understood it correctly we should be in exactly
this case (generic IC with dict mode receiver) and we still end up here.

+        receiver, it->name());
     // Migrate to the most up-to-date map that will be able to store |value|
     // under it->name() with |attributes|.
     it->PrepareTransitionToDataProperty(value, attributes, store_mode);