ArrayConcat regression recover after r20312 (appeared on dromaeo benchmarks).

src/elements.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ELEMENTS_H_
 #define V8_ELEMENTS_H_
 
 #include "src/elements-kind.h"
 #include "src/heap/heap.h"
 #include "src/isolate.h"
@@ skipping 128 matching lines @@
   // store is available, it can be passed in source and source_holder is
   // ignored.
   virtual void CopyElements(
       Handle<FixedArrayBase> source,
       uint32_t source_start,
       ElementsKind source_kind,
       Handle<FixedArrayBase> destination,
       uint32_t destination_start,
       int copy_size) = 0;
 
-  // TODO(ishell): Keeping |source_holder| parameter in a non-handlified form
-  // helps avoiding ArrayConcat() builtin performance degradation.
-  // Revisit this later.
+  // NOTE: this method violates the handlified function signature convention:
+  // raw pointer parameter |source_holder| in the function that allocates.
+  // This is done intentionally to avoid ArrayConcat() builtin performance
+  // degradation.
   virtual void CopyElements(
       JSObject* source_holder,
       uint32_t source_start,
       ElementsKind source_kind,
       Handle<FixedArrayBase> destination,
       uint32_t destination_start,
       int copy_size) = 0;
 
   inline void CopyElements(
       Handle<JSObject> from_holder,
@@ skipping 54 matching lines @@
 void CheckArrayAbuse(Handle<JSObject> obj, const char* op, uint32_t key,
                      bool allow_appending = false);
 
 MUST_USE_RESULT MaybeHandle<Object> ArrayConstructInitializeElements(
     Handle<JSArray> array,
     Arguments* args);
 
 } }  // namespace v8::internal
 
 #endif  // V8_ELEMENTS_H_