[runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/contexts.h"
 #include "src/elements.h"
@@ skipping 973 matching lines @@
     if (JSObject::kMaxElementCount - estimate_nof_elements < element_estimate) {
       estimate_nof_elements = JSObject::kMaxElementCount;
     } else {
       estimate_nof_elements += element_estimate;
     }
   });
 
   // If estimated number of elements is more than half of length, a
   // fixed array (fast case) is more time and space-efficient than a
   // dictionary.
-  bool fast_case =
-      is_array_species && (estimate_nof_elements * 2) >= estimate_result_length;
+  bool fast_case = is_array_species &&
+                   (estimate_nof_elements * 2) >= estimate_result_length &&
+                   isolate->IsIsConcatSpreadableLookupChainIntact();
 
   if (fast_case && kind == FAST_DOUBLE_ELEMENTS) {
     Handle<FixedArrayBase> storage =
         isolate->factory()->NewFixedDoubleArray(estimate_result_length);
     int j = 0;
     bool failure = false;
     if (estimate_result_length > 0) {
       Handle<FixedDoubleArray> double_storage =
           Handle<FixedDoubleArray>::cast(storage);
       for (int i = 0; i < argument_count; i++) {
@@ skipping 1607 matching lines @@
         Runtime::kThrowIncompatibleMethodReceiver, context,
         assembler.HeapConstant(assembler.factory()->NewStringFromAsciiChecked(
             "Array Iterator.prototype.next", TENURED)),
         iterator);
     assembler.Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8