Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

src/runtime/runtime-array.cc

Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index b72a23a48018be48d87804b44ddba917bbe02e92..7dbfbba811be06af3f8b7f347938178daaabb9d2 100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -439,6 +439,27 @@ static void CollectElementIndices(Handle<JSObject> object, uint32_t range,
 }
 
 
+static bool IterateElementsSlow(Isolate* isolate, Handle<JSObject> receiver,
+                                uint32_t length, ArrayConcatVisitor* visitor) {
+  for (uint32_t i = 0; i < length; ++i) {
+    HandleScope loop_scope(isolate);
+    Maybe<bool> maybe = JSReceiver::HasElement(receiver, i);
+    if (!maybe.has_value) return false;
+    if (maybe.value) {
+      Handle<Object> element_value;
+      // Call GetElement on receiver, not its prototype, or getters won't
+      // have the correct receiver.
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+          isolate, element_value,
+          Runtime::GetElementOrCharAt(isolate, receiver, i), false);
+      visitor->visit(i, element_value);
+    }
+  }
+  visitor->increase_index_offset(length);
+  return true;
+}
+
+
 /**
  * A helper function that visits elements of a JSObject in numerical
  * order.
@@ -469,6 +490,10 @@ static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
     }
   }
 
+  if (receiver->elements() == isolate->heap()->empty_fixed_array()) {

[Dmitry Lomov (no reviews), 2014/12/16 15:25:45]

Let's aim for 'make it right, then make it fast' approach.
Let's go down this route for all 'unsafe' receivers.

[caitp (gmail), 2014/12/16 15:33:36]

So more of an `if (!(receiver->IsJSArray() || receiver->IsJSTypedArray()))`
thing?

+    return IterateElementsSlow(isolate, receiver, length, visitor);
+  }
+
   switch (receiver->GetElementsKind()) {
     case FAST_SMI_ELEMENTS:
     case FAST_ELEMENTS: