Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

src/runtime/runtime-array.cc

Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index b72a23a48018be48d87804b44ddba917bbe02e92..1d7b1713a7aa6ac1ec3c419c59935f80623696a3 100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -453,6 +453,17 @@ static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
                             ArrayConcatVisitor* visitor) {
   uint32_t length = 0;
 
+  if (receiver->IsJSValue()) {
+    Handle<Object> value(Handle<JSValue>::cast(receiver)->value(), isolate);
+    if (value->IsString()) {
+      receiver =
+          i::Runtime::StringToArray(isolate, Handle<String>::cast(value));
+    } else {
+      // Other wrapped types are not array-like.

[caitp (gmail), 2014/12/16 06:16:25]

I don't think this is really the right thing to do --- but other wrapper types
will simply crash here if their length value is greater than their elements
count, which is wrong.

[Dmitry Lomov (no reviews), 2014/12/16 07:27:30]

The following needs to be made to work:
Number.prototype[Symbol.isConcatSpreadable] = true;
Number.prototype[0] = 1;
Number.prototype[1] = 2;
Number.prototype.length = 2;
[].concat(new Number(42))
In fact, I am surprised you need to do anything special for String wrappers
here. If you do, you should have issues with other non-exotic objects as well.

+      return true;
+    }
+  }
+
   if (receiver->IsJSArray()) {
     Handle<JSArray> array(Handle<JSArray>::cast(receiver));
     length = static_cast<uint32_t>(array->length()->Number());