[runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS

test/mjsunit/regress/regress-crbug-668414.js

Index: test/mjsunit/regress/regress-crbug-668414.js
diff --git a/test/mjsunit/regress/regress-crbug-668414.js b/test/mjsunit/regress/regress-crbug-668414.js
new file mode 100644
index 0000000000000000000000000000000000000000..c37442081a56ba13cd3646aab76d7555781ad810
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-668414.js
@@ -0,0 +1,58 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testSmiArrayConcat() {
+  var result = [].concat([-12]);
+
+  assertEquals(1, result.length);
+  assertEquals([-12], result);
+})();
+
+(function testDoubleArrayConcat() {
+  var result = [].concat([-1073741825]);
+
+  assertEquals(1, result.length);
+  assertEquals([-1073741825], result);
+})();
+
+(function testSmiArrayNonConcatSpreadable() {
+  var array = [-10];
+  array[Symbol.isConcatSpreadable] = false;
+  var result = [].concat(array);
+
+  assertEquals(1, result.length);
+  assertEquals(1, result[0].length);
+  assertEquals([-10], result[0]);
+})();
+
+(function testDoubleArrayNonConcatSpreadable() {
+  var array = [-1073741825];
+  array[Symbol.isConcatSpreadable] = false;
+  var result = [].concat(array);
+
+  assertEquals(1, result.length);
+  assertEquals(1, result[0].length);
+  assertEquals([-1073741825], result[0]);
+})();
+
+Array.prototype[Symbol.isConcatSpreadable] = false;
+
+
+(function testSmiArray() {
+  var result = [].concat([-12]);
+
+  assertEquals(2, result.length);
+  assertEquals(0, result[0].length);
+  assertEquals(1, result[1].length);
+  assertEquals([-12], result[1]);
+})();
+
+(function testDoubleArray() {
+  var result = [].concat([-1073741825]);
+
+  assertEquals(2, result.length);
+  assertEquals(0, result[0].length);
+  assertEquals(1, result[1].length);
+  assertEquals([-1073741825], result[1]);
+})();