[runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS

A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
This commit is contained in:
cbruni 2016-11-28 02:06:07 -08:00 committed by Commit bot
parent b1a49fc2c3
commit a09e5eda26
2 changed files with 61 additions and 2 deletions

View File

@ -991,8 +991,9 @@ Object* Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
// If estimated number of elements is more than half of length, a
// fixed array (fast case) is more time and space-efficient than a
// dictionary.
bool fast_case =
is_array_species && (estimate_nof_elements * 2) >= estimate_result_length;
bool fast_case = is_array_species &&
(estimate_nof_elements * 2) >= estimate_result_length &&
isolate->IsIsConcatSpreadableLookupChainIntact();
if (fast_case && kind == FAST_DOUBLE_ELEMENTS) {
Handle<FixedArrayBase> storage =

View File

@ -0,0 +1,58 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testSmiArrayConcat() {
var result = [].concat([-12]);
assertEquals(1, result.length);
assertEquals([-12], result);
})();
(function testDoubleArrayConcat() {
var result = [].concat([-1073741825]);
assertEquals(1, result.length);
assertEquals([-1073741825], result);
})();
(function testSmiArrayNonConcatSpreadable() {
var array = [-10];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-10], result[0]);
})();
(function testDoubleArrayNonConcatSpreadable() {
var array = [-1073741825];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-1073741825], result[0]);
})();
Array.prototype[Symbol.isConcatSpreadable] = false;
(function testSmiArray() {
var result = [].concat([-12]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-12], result[1]);
})();
(function testDoubleArray() {
var result = [].concat([-1073741825]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-1073741825], result[1]);
})();