Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

src/runtime/runtime-strings.cc

Index: src/runtime/runtime-strings.cc
diff --git a/src/runtime/runtime-strings.cc b/src/runtime/runtime-strings.cc
index df2210c635198410a939c26529a01948a3e5f6aa..8bba9d966b34479c67f87d2a5d23036f9d2b16d4 100644
--- a/src/runtime/runtime-strings.cc
+++ b/src/runtime/runtime-strings.cc
@@ -801,14 +801,8 @@ static int CopyCachedOneByteCharsToArray(Heap* heap, const uint8_t* chars,
 }
 
 
-// Converts a String to JSArray.
-// For example, "foo" => ["f", "o", "o"].
-RUNTIME_FUNCTION(Runtime_StringToArray) {
-  HandleScope scope(isolate);
-  DCHECK(args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
-  CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
-
+Handle<JSArray> Runtime::StringToArray(Isolate* isolate, Handle<String> s,
+                                       uint32_t limit) {
   s = String::Flatten(s);
   const int length = static_cast<int>(Min<uint32_t>(s->length(), limit));
 
@@ -845,7 +839,19 @@ RUNTIME_FUNCTION(Runtime_StringToArray) {
   }
 #endif
 
-  return *isolate->factory()->NewJSArrayWithElements(elements);
+  return isolate->factory()->NewJSArrayWithElements(elements);
+}
+
+
+// Converts a String to JSArray.
+// For example, "foo" => ["f", "o", "o"].
+RUNTIME_FUNCTION(Runtime_StringToArray) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 2);
+  CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
+  CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
+
+  return *Runtime::StringToArray(isolate, s, limit);
 }