Split up mjsunit/es6/array-concat.js

Split up the test so each test runs in a fresh Isolate with pristine
protector state.

Note that testArrayConcatES5 was not split out because it is a duplicate
of mjsunit/array-concat.js, and testConcatRevokedProxy has already been
split out as mjsunit/es6/array-concat-revocable-revoked-proxy-[12].js.

Bug: v8:9837
Change-Id: I8f744b0263c82f1dae61a55032124d9129f8e6f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864007Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64366}

test/mjsunit/es6/array-concat-arity.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+assertEquals(1, Array.prototype.concat.length);

test/mjsunit/es6/array-concat-array-subclass.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+// If @@isConcatSpreadable is not used, the value of IsArray(O)
+// is used to determine the spreadable property.
+class A extends Array {}
+var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
+assertEquals(9, obj.length);
+for (var i = 0; i < obj.length; ++i) {
+  assertEquals(i + 1, obj[i]);
+}
+
+// TODO(caitp): when concat is called on instances of classes which extend
+// Array, they should:
+//
+// - return an instance of the class, rather than an Array instance (if from
+//   same Realm)
+// - always treat such classes as concat-spreadable

test/mjsunit/es6/array-concat-arraylike-length-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": {valueOf: null, toString: null},
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertThrows(function() {
+  Array.prototype.concat.call(obj, obj2, arr);
+}, TypeError);

test/mjsunit/es6/array-concat-arraylike-length-tostring-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {
+  "length": { toString: function() {
+      throw new MyError();
+    }, valueOf: null
+  },
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);

test/mjsunit/es6/array-concat-arraylike-length-valueof-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {
+  "length": { valueOf: function() {
+    throw new MyError();
+  }, toString: null
+},
+"1": "A",
+"3": "B",
+"5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);

test/mjsunit/es6/array-concat-arraylike-negative-length.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": -6,
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+assertEquals([], [].concat(obj));
+obj.length = -6.7;
+assertEquals([], [].concat(obj));
+obj.length = "-6";
+assertEquals([], [].concat(obj));

test/mjsunit/es6/array-concat-arraylike-primitive-nonnumber-length.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+obj.length = {toString: function() { return "SIX"; }, valueOf: null };
+assertEquals([], [].concat(obj));
+obj.length = {toString: null, valueOf: function() { return "SIX"; } };
+assertEquals([], [].concat(obj));

test/mjsunit/es6/array-concat-arraylike-string-length.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": "6",
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertEquals([void 0, "A", void 0, "B", void 0, "C",
+             { "length": 3, "0": "0", "1": "1", "2": "2" },
+             "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));

test/mjsunit/es6/array-concat-arraylike.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = {
+  "length": 6,
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+obj[Symbol.isConcatSpreadable] = true;
+var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+var arr = ["X", "Y", "Z"];
+assertEquals([void 0, "A", void 0, "B", void 0, "C",
+             { "length": 3, "0": "0", "1": "1", "2": "2" },
+             "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));

test/mjsunit/es6/array-concat-descriptor.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var desc = Object.getOwnPropertyDescriptor(Array.prototype, 'concat');
+assertEquals(false, desc.enumerable);

test/mjsunit/es6/array-concat-holey-array.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var arr = [];
+arr[4] = "Item 4";
+arr[8] = "Item 8";
+var arr2 = [".", "!", "?"];
+assertEquals([void 0, void 0, void 0, void 0, "Item 4", void 0, void 0,
+              void 0, "Item 8", ".", "!", "?"], arr.concat(arr2));

test/mjsunit/es6/array-concat-isconcatspreadable-getter-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {};
+Object.defineProperty(obj, Symbol.isConcatSpreadable, {
+  get: function() { throw new MyError(); }
+});
+
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
+
+assertThrows(function() {
+  Array.prototype.concat.call(obj, 1, 2, 3);
+}, MyError);

test/mjsunit/es6/array-concat-length-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function MyError() {}
+var obj = {};
+obj[Symbol.isConcatSpreadable] = true;
+Object.defineProperty(obj, "length", {
+  get: function() { throw new MyError(); }
+});
+
+assertThrows(function() {
+  [].concat(obj);
+}, MyError);
+
+assertThrows(function() {
+  Array.prototype.concat.call(obj, 1, 2, 3);
+}, MyError);

test/mjsunit/es6/array-concat-no-prototype.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+assertEquals(void 0, Array.prototype.concat.prototype);

test/mjsunit/es6/array-concat-nonarray.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+class NonArray {
+  constructor() { Array.apply(this, arguments); }
+};
+
+var obj = new NonArray(1,2,3);
+var result = Array.prototype.concat.call(obj, 4, 5, 6);
+assertEquals(Array, result.constructor);
+assertEquals([obj,4,5,6], result);
+assertFalse(result instanceof NonArray);

test/mjsunit/es6/array-concat-sloppy-arguments-holey.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a) { return arguments; })(1,2,3);
+delete args[1];
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, void 0, 3, 1, void 0, 3], [].concat(args, args));

test/mjsunit/es6/array-concat-sloppy-arguments-throws.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function MyError() {}
+var args = (function(a) { return arguments; })(1,2,3);
+Object.defineProperty(args, 0, {
+  get: function() { throw new MyError(); }
+});
+args[Symbol.isConcatSpreadable] = true;
+assertThrows(function() {
+  return [].concat(args, args);
+}, MyError);

test/mjsunit/es6/array-concat-sloppy-arguments-with-dupes.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, a, a) { return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));

test/mjsunit/es6/array-concat-sloppy-arguments.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, b, c) { return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));

test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-bogus-length.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var getTrap = function(t, key) {
+  if (key === "length") return Symbol();
+  if (key === "2") return "baz";
+  if (key === "3") return "bar";
+};
+var target = [];
+var obj = new Proxy(target, {get: getTrap, has: () => true});
+
+assertThrows(() => [].concat(obj), TypeError);
+assertThrows(() => Array.prototype.concat.apply(obj), TypeError);

test/mjsunit/es6/array-concat-spreadable-arraylike-proxy-length.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var getTrap = function(t, key) {
+  if (key === "length") return {[Symbol.toPrimitive]() {return 3}};
+  if (key === "2") return "baz";
+  if (key === "3") return "bar";
+};
+var target = [];
+var obj = new Proxy(target, {get: getTrap, has: () => true});
+
+assertEquals([undefined, undefined, "baz"], [].concat(obj));
+assertEquals([undefined, undefined, "baz"], Array.prototype.concat.apply(obj))

test/mjsunit/es6/array-concat-spreadable-arraylike-proxy.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = ["a", "b"];
+target[Symbol.isConcatSpreadable] = undefined;
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals(["a", "b"], [].concat(obj));
+assertEquals(6, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+
+log.length = 0;
+assertEquals(["a", "b"], Array.prototype.concat.apply(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, "constructor", obj], log[0]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);
+assertEquals(["get", target, "length", obj], log[2]);
+assertEquals(["has", target, "0"], log[3]);
+assertEquals(["get", target, "0", obj], log[4]);
+assertEquals(["has", target, "1"], log[5]);
+assertEquals(["get", target, "1", obj], log[6]);

test/mjsunit/es6/array-concat-spreadable-boolean-wrapper.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var bool = new Boolean(true)
+// Boolean wrapper objects are not concat-spreadable by default
+assertEquals([bool], [].concat(bool));
+
+// Boolean wrapper objects may be individually concat-spreadable
+bool[Symbol.isConcatSpreadable] = true;
+bool.length = 3;
+bool[0] = 1, bool[1] = 2, bool[2] = 3;
+assertEquals([1, 2, 3], [].concat(bool));
+
+Boolean.prototype[Symbol.isConcatSpreadable] = true;
+// Boolean wrapper objects may be concat-spreadable
+assertEquals([], [].concat(new Boolean(true)));
+Boolean.prototype[0] = 1;
+Boolean.prototype[1] = 2;
+Boolean.prototype[2] = 3;
+Boolean.prototype.length = 3;
+assertEquals([1,2,3], [].concat(new Boolean(true)));
+
+// Boolean values are never concat-spreadable
+assertEquals([true], [].concat(true));

test/mjsunit/es6/array-concat-spreadable-function.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var fn = function(a, b, c) {}
+// Functions are not concat-spreadable by default
+assertEquals([fn], [].concat(fn));
+
+// Functions may be individually concat-spreadable
+fn[Symbol.isConcatSpreadable] = true;
+fn[0] = 1, fn[1] = 2, fn[2] = 3;
+assertEquals([1, 2, 3], [].concat(fn));
+
+Function.prototype[Symbol.isConcatSpreadable] = true;
+// Functions may be concat-spreadable
+assertEquals([void 0, void 0, void 0], [].concat(function(a,b,c) {}));
+Function.prototype[0] = 1;
+Function.prototype[1] = 2;
+Function.prototype[2] = 3;
+assertEquals([1,2,3], [].concat(function(a, b, c) {}));

test/mjsunit/es6/array-concat-spreadable-nonarraylike-proxy.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = {0: "a", 1: "b", [Symbol.isConcatSpreadable]: "truish"};
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([], [].concat(obj));
+assertEquals(2, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+
+log.length = 0;
+assertEquals([], Array.prototype.concat.apply(obj));
+assertEquals(2, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+
+target.length = 3;
+
+log.length = 0;
+assertEquals(["a", "b", undefined], [].concat(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+assertEquals(["has", target, "2"], log[6]);
+
+log.length = 0;
+assertEquals(["a", "b", undefined], Array.prototype.concat.apply(obj));
+assertEquals(7, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+assertEquals(["get", target, "length", obj], log[1]);
+assertEquals(["has", target, "0"], log[2]);
+assertEquals(["get", target, "0", obj], log[3]);
+assertEquals(["has", target, "1"], log[4]);
+assertEquals(["get", target, "1", obj], log[5]);
+assertEquals(["has", target, "2"], log[6]);

test/mjsunit/es6/array-concat-spreadable-number-wrapper.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var num = new Number(true)
+// Number wrapper objects are not concat-spreadable by default
+assertEquals([num], [].concat(num));
+
+// Number wrapper objects may be individually concat-spreadable
+num[Symbol.isConcatSpreadable] = true;
+num.length = 3;
+num[0] = 1, num[1] = 2, num[2] = 3;
+assertEquals([1, 2, 3], [].concat(num));
+
+Number.prototype[Symbol.isConcatSpreadable] = true;
+// Number wrapper objects may be concat-spreadable
+assertEquals([], [].concat(new Number(123)));
+Number.prototype[0] = 1;
+Number.prototype[1] = 2;
+Number.prototype[2] = 3;
+Number.prototype.length = 3;
+assertEquals([1,2,3], [].concat(new Number(123)));
+
+// Number values are never concat-spreadable
+assertEquals([true], [].concat(true));

test/mjsunit/es6/array-concat-spreadable-regexp.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var re = /abc/;
+// RegExps are not concat-spreadable by default
+assertEquals([re], [].concat(re));
+
+// RegExps may be individually concat-spreadable
+re[Symbol.isConcatSpreadable] = true;
+re[0] = 1, re[1] = 2, re[2] = 3, re.length = 3;
+assertEquals([1, 2, 3], [].concat(re));
+
+// RegExps may be concat-spreadable
+RegExp.prototype[Symbol.isConcatSpreadable] = true;
+RegExp.prototype.length = 3;
+
+assertEquals([void 0, void 0, void 0], [].concat(/abc/));
+RegExp.prototype[0] = 1;
+RegExp.prototype[1] = 2;
+RegExp.prototype[2] = 3;
+assertEquals([1,2,3], [].concat(/abc/));

test/mjsunit/es6/array-concat-spreadable-sparse-object.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var obj = { length: 5 };
+obj[Symbol.isConcatSpreadable] = true;
+assertEquals([void 0, void 0, void 0, void 0, void 0], [].concat(obj));
+
+obj.length = 4000;
+assertEquals(new Array(4000), [].concat(obj));

test/mjsunit/es6/array-concat-spreadable-string-wrapper.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var str1 = new String("yuck\uD83D\uDCA9")
+// String wrapper objects are not concat-spreadable by default
+assertEquals([str1], [].concat(str1));
+
+// String wrapper objects may be individually concat-spreadable
+str1[Symbol.isConcatSpreadable] = true;
+assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
+             [].concat(str1));
+
+String.prototype[Symbol.isConcatSpreadable] = true;
+// String wrapper objects may be concat-spreadable
+assertEquals(["y", "u", "c", "k", "\uD83D", "\uDCA9"],
+             [].concat(new String("yuck\uD83D\uDCA9")));
+
+// String values are never concat-spreadable
+assertEquals(["yuck\uD83D\uDCA9"], [].concat("yuck\uD83D\uDCA9"));

test/mjsunit/es6/array-concat-strict-arguments.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var args = (function(a, b, c) { "use strict"; return arguments; })(1,2,3);
+args[Symbol.isConcatSpreadable] = true;
+assertEquals([1, 2, 3, 1, 2, 3], [].concat(args, args));
+
+Object.defineProperty(args, "length", { value: 6 });
+assertEquals([1, 2, 3, void 0, void 0, void 0], [].concat(args));

test/mjsunit/es6/array-concat-typedarray.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function testConcatTypedArray(type, elems, modulo) {
+  "use strict";
+  var items = new Array(elems);
+  var ta_by_len = new type(elems);
+  for (var i = 0; i < elems; ++i) {
+    ta_by_len[i] = items[i] = modulo === false ? i : elems % modulo;
+  }
+  var ta = new type(items);
+  assertEquals([ta, ta], [].concat(ta, ta));
+  ta[Symbol.isConcatSpreadable] = true;
+  assertEquals(items, [].concat(ta));
+
+  assertEquals([ta_by_len, ta_by_len], [].concat(ta_by_len, ta_by_len));
+  ta_by_len[Symbol.isConcatSpreadable] = true;
+  assertEquals(items, [].concat(ta_by_len));
+
+  // TypedArray with fake `length`.
+  ta = new type(1);
+  var defValue = ta[0];
+  var expected = new Array(4000);
+  expected[0] = defValue;
+
+  Object.defineProperty(ta, "length", { value: 4000 });
+  ta[Symbol.isConcatSpreadable] = true;
+  assertEquals(expected, [].concat(ta));
+}
+
+(function testConcatSmallTypedArray() {
+  var length = 1;
+  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
+  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
+  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
+  testConcatTypedArray(Float32Array, length, false);
+  testConcatTypedArray(Float64Array, length, false);
+})();
+
+
+(function testConcatLargeTypedArray() {
+  var length = 4000;
+  testConcatTypedArray(Uint8Array, length, Math.pow(2, 8));
+  testConcatTypedArray(Uint16Array, length, Math.pow(2, 16));
+  testConcatTypedArray(Uint32Array, length,  Math.pow(2, 32));
+  testConcatTypedArray(Float32Array, length, false);
+  testConcatTypedArray(Float64Array, length, false);
+})();

test/mjsunit/es6/array-concat-unspreadable-array-subclass.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+class A extends Array {
+  get [Symbol.isConcatSpreadable]() { return false; }
+}
+var obj = [].concat(new A(1, 2, 3), new A(4, 5, 6), new A(7, 8, 9));
+assertEquals(3, obj.length);
+assertEquals(3, obj[0].length);
+assertEquals(3, obj[1].length);
+assertEquals(3, obj[2].length);

test/mjsunit/es6/array-concat-unspreadable-array.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var array = [1, 2, 3];
+assertEquals(array, [].concat(array));
+assertEquals(array, array.concat([]));
+array[Symbol.isConcatSpreadable] = false;
+assertEquals([[1,2,3]], [].concat(array));
+assertEquals([[1,2,3]], array.concat([]));

test/mjsunit/es6/array-concat-unspreadable-arraylike-proxy.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = ["a", "b"];
+target[Symbol.isConcatSpreadable] = "";
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([obj], [].concat(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+
+log.length = 0;
+assertEquals([obj], Array.prototype.concat.apply(obj));
+assertEquals(2, log.length);  // An extra read for the constructor
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, "constructor", obj], log[0]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[1]);

test/mjsunit/es6/array-concat-unspreadable-nonarraylike-proxy.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: concat does not currently support species so there is no difference
+// between [].concat(foo) and Array.prototype.concat.apply(foo).
+
+var log = [];
+var logger = {};
+var handler = new Proxy({}, logger);
+
+logger.get = function(t, trap, r) {
+  return function(...args) {
+    log.push([trap, ...args]);
+    return Reflect[trap](...args);
+  }
+};
+
+var target = {0: "a", 1: "b"};
+var obj = new Proxy(target, handler);
+
+log.length = 0;
+assertEquals([obj], [].concat(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);
+
+log.length = 0;
+assertEquals([obj], Array.prototype.concat.apply(obj));
+assertEquals(1, log.length);
+for (var i in log) assertSame(target, log[i][1]);
+assertEquals(["get", target, Symbol.isConcatSpreadable, obj], log[0]);

test/mjsunit/mjsunit.status

@@ -256,6 +256,9 @@
   # Test doesn't work on 32-bit architectures (it would require a
   # regexp pattern with too many captures).
   'regress/regress-976627': [FAIL, ['arch == x64 or arch == arm64 or arch == mips64el or arch == ppc64 or arch == s390x', PASS]],
+
+  # BUG(v8:9837)
+  'es6/array-concat-unspreadable-array-subclass': [FAIL],
 }],  # ALWAYS
 
 ['novfp3 == True', {
@@ -505,7 +508,6 @@
 ['arch == arm64 and simulator_run', {
   # Slow in simulator builds
   'compiler/osr-follow': [PASS, SLOW],
-  'es6/array-concat': [PASS, SLOW],
   'non-extensible-array-reduce': [PASS, SLOW],
   'regress/regress-454725': [PASS, SLOW],
   'regress/regress-708247': [PASS, SLOW],