Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/runtime/runtime-utils.h"
 
 namespace v8 {
@@ skipping 435 matching lines @@
  * The visitor argument called for each existing element in the array
  * with the element index and the element's value.
  * Afterwards it increments the base-index of the visitor by the array
  * length.
  * Returns false if any access threw an exception, otherwise true.
  */
 static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
                             ArrayConcatVisitor* visitor) {
   uint32_t length = 0;
 
+  if (receiver->IsJSValue()) {
+    Handle<Object> value(Handle<JSValue>::cast(receiver)->value(), isolate);
+    if (value->IsString()) {
+      receiver =
+          i::Runtime::StringToArray(isolate, Handle<String>::cast(value));
+    } else {
+      // Other wrapped types are not array-like.

[caitp (gmail), 2014/12/16 06:16:25]

I don't think this is really the right thing to do --- but other wrapper types
will simply crash here if their length value is greater than their elements
count, which is wrong.

[Dmitry Lomov (no reviews), 2014/12/16 07:27:30]

The following needs to be made to work:
Number.prototype[Symbol.isConcatSpreadable] = true;
Number.prototype[0] = 1;
Number.prototype[1] = 2;
Number.prototype.length = 2;
[].concat(new Number(42))
In fact, I am surprised you need to do anything special for String wrappers
here. If you do, you should have issues with other non-exotic objects as well.

+      return true;
+    }
+  }
+
   if (receiver->IsJSArray()) {
     Handle<JSArray> array(Handle<JSArray>::cast(receiver));
     length = static_cast<uint32_t>(array->length()->Number());
   } else {
     Handle<Object> val;
     Handle<Object> key(isolate->heap()->length_string(), isolate);
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
         Runtime::GetObjectProperty(isolate, receiver, key), false);
     // TODO(caitp): Support larger element indexes (up to 2^53-1).
     if (!val->ToUint32(&length)) {
@@ skipping 817 matching lines @@
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_FastOneByteArrayJoin) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   return isolate->heap()->undefined_value();
 }
 }
 }  // namespace v8::internal