Implement ES6 @@isConcatSpreadable

src/runtime/runtime-array.cc

Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index 523d8f5faa30653a0aae97e5d58096ef53bd3c4c..74d43f23ea764391cd8a523a4a07727253261f94 100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -440,7 +440,7 @@ static void CollectElementIndices(Handle<JSObject> object, uint32_t range,
 
 
 /**
- * A helper function that visits elements of a JSArray in numerical
+ * A helper function that visits elements of a JSObject in numerical
  * order.
  *
  * The visitor argument called for each existing element in the array
@@ -449,9 +449,22 @@ static void CollectElementIndices(Handle<JSObject> object, uint32_t range,
  * length.
  * Returns false if any access threw an exception, otherwise true.
  */
-static bool IterateElements(Isolate* isolate, Handle<JSArray> receiver,
+static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
                             ArrayConcatVisitor* visitor) {
-  uint32_t length = static_cast<uint32_t>(receiver->length()->Number());
+  uint32_t length = 0;
+
+  if (receiver->IsJSArray()) {
+    Handle<JSArray> array(Handle<JSArray>::cast(receiver));
+    length = static_cast<uint32_t>(array->length()->Number());
+  } else {
+    Handle<Object> val;
+    Handle<Object> key(isolate->heap()->length_string(), isolate);
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
+        Runtime::GetObjectProperty(isolate, receiver, key), false);

[Dmitry Lomov (no reviews), 2014/12/10 10:58:20]

Here you use whatever length the incoming object gives you, so it does not have
"the amazing Array length behavior". This means that the assumptions in
remainder of this method do not hold, in particular DCHECKs in lines 477 and
511.

[Dmitry Lomov (no reviews), 2014/12/10 14:41:59]

Ah ok sorry I jumped the gun here, FAST_(SMI|DOUBLE)_(HOLEY_)ELEMENTS are indeed
JSArray only

+    // TODO(caitp): implement ToLength() abstract operation for C++
+    val->ToUint32(&length);
+  }
+
   switch (receiver->GetElementsKind()) {
     case FAST_SMI_ELEMENTS:
     case FAST_ELEMENTS:
@@ -601,6 +614,23 @@ static bool IterateElements(Isolate* isolate, Handle<JSArray> receiver,
 }
 
 
+static bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
+  HandleScope handle_scope(isolate);
+  if (!obj->IsSpecObject()) return false;
+  if (obj->IsJSArray()) return true;
+  if (FLAG_harmony_arrays) {
+    Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
+    Handle<Object> value;
+    MaybeHandle<Object> maybeValue =
+        i::Runtime::GetObjectProperty(isolate, obj, key);
+    if (maybeValue.ToHandle(&value)) {
+      return value->BooleanValue();
+    }
+  }
+  return false;
+}
+
+
 /**
  * Array::concat implementation.
  * See ECMAScript 262, 15.4.4.4.
@@ -771,9 +801,11 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
 
   for (int i = 0; i < argument_count; i++) {
     Handle<Object> obj(elements->get(i), isolate);
-    if (obj->IsJSArray()) {
-      Handle<JSArray> array = Handle<JSArray>::cast(obj);
-      if (!IterateElements(isolate, array, &visitor)) {
+    bool spreadable = IsConcatSpreadable(isolate, obj);
+    if (isolate->has_pending_exception()) return isolate->heap()->exception();
+    if (spreadable) {
+      Handle<JSObject> object = Handle<JSObject>::cast(obj);
+      if (!IterateElements(isolate, object, &visitor)) {
         return isolate->heap()->exception();
       }
     } else {