[builtins] Fix Array.prototype.concat bug

[builtins] Fix Array.prototype.concat bug

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y

Committed: https://crrev.com/96a2bd8ae8c25e2acbe63319011cbb829b59e3df
Cr-Commit-Position: refs/heads/master@{#34798}

[Camillo Bruni, 2016-03-15 13:37:16]

cbruni@chromium.org changed reviewers:
+ verwaest@chromium.org

[Camillo Bruni, 2016-03-15 13:37:17]

PTAL

[Toon Verwaest, 2016-03-15 16:15:39]

You missed slow string wrappers in elements.cc. Also line 1421 in builtins.cc is
a slightly odd change...

[Camillo Bruni, 2016-03-15 16:16:33]

Description was changed from

==========
[builtins] Fix Array.prototype.concat might expose raw memory

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain. Due do side-effects introduced by
invoking getters during fast-path concatenation we might GC and move the
backing-store exposing raw memory through unchecked FixedArray::get.

BUG=chromium:594574
LOG=y
==========

to

==========
[builtins] Fix Array.prototype.concat might expose raw memory

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain. Due do side-effects introduced by
invoking getters during fast-path concatenation we might GC and right-trim
the backing-store, exposing raw memory through unchecked FixedArray::get.

BUG=chromium:594574
LOG=y
==========

[Toon Verwaest, 2016-03-15 19:10:15]

lgtm with one comment.

https://codereview.chromium.org/1804963002/diff/20001/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/1804963002/diff/20001/src/builtins.cc#newcode...
src/builtins.cc:1096: if (!HasOnlySimpleElements(isolate, *receiver)) {
I'd keep the IsJSArray for now to ensure that the Min below isn't necessary
(it's wrong anyway...)

[Camillo Bruni, 2016-03-15 20:07:21]

Description was changed from

==========
[builtins] Fix Array.prototype.concat might expose raw memory

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain. Due do side-effects introduced by
invoking getters during fast-path concatenation we might GC and right-trim
the backing-store, exposing raw memory through unchecked FixedArray::get.

BUG=chromium:594574
LOG=y
==========

to

==========
[builtins] Fix Array.prototype.concat might expose raw memory

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y
==========

[Camillo Bruni, 2016-03-15 20:07:24]

The CQ bit was checked by cbruni@chromium.org

[Camillo Bruni, 2016-03-15 20:07:24]

The patchset sent to the CQ was uploaded after l-g-t-m from
verwaest@chromium.org
Link to the patchset: https://codereview.chromium.org/1804963002/#ps40001
(title: "polishing corner cases and making tests work")

[commit-bot: I haz the power, 2016-03-15 20:07:28]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1804963002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1804963002/40001

[Camillo Bruni, 2016-03-15 20:07:52]

Description was changed from

==========
[builtins] Fix Array.prototype.concat might expose raw memory

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y
==========

to

==========
[builtins] Fix Array.prototype.concat bug

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y
==========

[Camillo Bruni, 2016-03-15 20:07:59]

The CQ bit was unchecked by cbruni@chromium.org

[Camillo Bruni, 2016-03-15 20:08:15]

The CQ bit was checked by cbruni@chromium.org

[Camillo Bruni, 2016-03-15 20:08:15]

The CQ bit was checked by cbruni@chromium.org

[commit-bot: I haz the power, 2016-03-15 20:08:18]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1804963002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1804963002/40001

[commit-bot: I haz the power, 2016-03-15 20:28:21]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-03-15 20:29:36]

Description was changed from

==========
[builtins] Fix Array.prototype.concat bug

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y
==========

to

==========
[builtins] Fix Array.prototype.concat bug

Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y

Committed: https://crrev.com/96a2bd8ae8c25e2acbe63319011cbb829b59e3df
Cr-Commit-Position: refs/heads/master@{#34798}
==========

[commit-bot: I haz the power, 2016-03-15 20:29:38]

Patchset 3 (id:??) landed as
https://crrev.com/96a2bd8ae8c25e2acbe63319011cbb829b59e3df
Cr-Commit-Position: refs/heads/master@{#34798}