Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/runtime/runtime-utils.h"
 
 namespace v8 {
@@ skipping 421 matching lines @@
   if (!iter.IsAtEnd()) {
     // The prototype will usually have no inherited element indices,
     // but we have to check.
     CollectElementIndices(
         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)), range,
         indices);
   }
 }
 
 
+static bool IterateElementsSlow(Isolate* isolate, Handle<JSObject> receiver,
+                                uint32_t length, ArrayConcatVisitor* visitor) {
+  for (uint32_t i = 0; i < length; ++i) {
+    HandleScope loop_scope(isolate);
+    Maybe<bool> maybe = JSReceiver::HasElement(receiver, i);
+    if (!maybe.has_value) return false;
+    if (maybe.value) {
+      Handle<Object> element_value;
+      // Call GetElement on receiver, not its prototype, or getters won't
+      // have the correct receiver.
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+          isolate, element_value,
+          Runtime::GetElementOrCharAt(isolate, receiver, i), false);
+      visitor->visit(i, element_value);
+    }
+  }
+  visitor->increase_index_offset(length);
+  return true;
+}
+
+
 /**
  * A helper function that visits elements of a JSObject in numerical
  * order.
  *
  * The visitor argument called for each existing element in the array
  * with the element index and the element's value.
  * Afterwards it increments the base-index of the visitor by the array
  * length.
  * Returns false if any access threw an exception, otherwise true.
  */
@@ skipping 10 matching lines @@
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
         Runtime::GetObjectProperty(isolate, receiver, key), false);
     // TODO(caitp): Support larger element indexes (up to 2^53-1).
     if (!val->ToUint32(&length)) {
       ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
           Execution::ToLength(isolate, val), false);
       val->ToUint32(&length);
     }
   }
 
+  if (receiver->elements() == isolate->heap()->empty_fixed_array()) {

[Dmitry Lomov (no reviews), 2014/12/16 15:25:45]

Let's aim for 'make it right, then make it fast' approach.
Let's go down this route for all 'unsafe' receivers.

[caitp (gmail), 2014/12/16 15:33:36]

So more of an `if (!(receiver->IsJSArray() || receiver->IsJSTypedArray()))`
thing?

+    return IterateElementsSlow(isolate, receiver, length, visitor);
+  }
+
   switch (receiver->GetElementsKind()) {
     case FAST_SMI_ELEMENTS:
     case FAST_ELEMENTS:
     case FAST_HOLEY_SMI_ELEMENTS:
     case FAST_HOLEY_ELEMENTS: {
       // Run through the elements FixedArray and use HasElement and GetElement
       // to check the prototype for missing elements.
       Handle<FixedArray> elements(FixedArray::cast(receiver->elements()));
       int fast_length = static_cast<int>(length);
       DCHECK(fast_length <= elements->length());
@@ skipping 801 matching lines @@
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_FastOneByteArrayJoin) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   return isolate->heap()->undefined_value();
 }
 }
 }  // namespace v8::internal