Use proper ToLength() operation in %ArrayConcat()

src/runtime/runtime-array.cc

Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index 1df42c424c33f9ee06112b0e80d241b3ca0390f4..77c522f78c4643ebe9cb12e5dab20ff63f8cd8e2 100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -461,7 +461,10 @@ static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
     Handle<Object> key(isolate->heap()->length_string(), isolate);
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
         Runtime::GetObjectProperty(isolate, receiver, key), false);
-    // TODO(caitp): implement ToLength() abstract operation for C++
+    // TODO(caitp): ToLength(Get(receiver, "length")) should be a single op.

[caitp (gmail), 2014/12/13 02:00:47]

I'm not sure how big of a problem this is, but it seems simpler to just call the
JS implementation of ToLength() rather than write it in C++. The perf-impact
should only affect uses of Symbol.isConcatSpreadable, so it probably won't
matter much in most cases.

[Dmitry Lomov (no reviews), 2014/12/13 10:42:48]

You should handle simple cases in C++ here (e.g. when val is already a number,
just convert directly without calling into JS)

+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
+        Execution::ToLength(isolate, val), false);
+    // TODO(caitp): Support larger element indexes (up to 2^53-1).
     val->ToUint32(&length);
   }