Guard @@isConcatSpreadable behind a flag

The breakage to Chrome seems to be based on @@isConcatSpreadable
and turning that part off with this patch fixes the Maps Tips & Tricks
test case.

BUG=chromium:507553
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1226063002

Cr-Commit-Position: refs/heads/master@{#29545}

BUILD.gn

@@ -273,6 +273,7 @@ action("js2c_experimental") {
     "src/generator.js",
     "src/harmony-atomics.js",
     "src/harmony-array-includes.js",
+    "src/harmony-concat-spreadable.js",
     "src/harmony-tostring.js",
     "src/harmony-regexp.js",
     "src/harmony-reflect.js",

src/bootstrapper.cc

@@ -1819,6 +1819,7 @@ EMPTY_NATIVE_FUNCTIONS_FOR_FEATURE(harmony_spread_arrays)
 EMPTY_NATIVE_FUNCTIONS_FOR_FEATURE(harmony_sharedarraybuffer)
 EMPTY_NATIVE_FUNCTIONS_FOR_FEATURE(harmony_atomics)
 EMPTY_NATIVE_FUNCTIONS_FOR_FEATURE(harmony_new_target)
+EMPTY_NATIVE_FUNCTIONS_FOR_FEATURE(harmony_concat_spreadable)
 
 
 void Genesis::InstallNativeFunctions_harmony_proxies() {
@@ -1850,6 +1851,7 @@ EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_object)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_spread_arrays)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_atomics)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_new_target)
+EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_concat_spreadable)
 
 void Genesis::InitializeGlobal_harmony_regexps() {
   Handle<JSObject> builtins(native_context()->builtins());
@@ -2500,6 +2502,8 @@ bool Genesis::InstallExperimentalNatives() {
   static const char* harmony_atomics_natives[] = {"native harmony-atomics.js",
                                                   nullptr};
   static const char* harmony_new_target_natives[] = {nullptr};
+  static const char* harmony_concat_spreadable_natives[] = {
+      "native harmony-concat-spreadable.js", nullptr};
 
   for (int i = ExperimentalNatives::GetDebuggerCount();
        i < ExperimentalNatives::GetBuiltinsCount(); i++) {

src/flag-definitions.h

@@ -199,8 +199,9 @@ DEFINE_BOOL(legacy_const, true, "legacy semantics for const in sloppy mode")
   V(harmony_new_target, "harmony new.target")
 
 // Features that are complete (but still behind --harmony/es-staging flag).
-#define HARMONY_STAGED(V)                 \
-  V(harmony_tostring, "harmony toString") \
+#define HARMONY_STAGED(V)                                       \
+  V(harmony_tostring, "harmony toString")                       \
+  V(harmony_concat_spreadable, "harmony isConcatSpreadable")    \
   V(harmony_rest_parameters, "harmony rest parameters")
 
 // Features that are shipping (turned on by default, but internal flag remains).

src/harmony-array.js

@@ -287,11 +287,6 @@ function ArrayOf() {
 
 // -------------------------------------------------------------------
 
-utils.InstallConstants(GlobalSymbol, [
-  // TODO(dslomov, caitp): Move to symbol.js when shipping
-  "isConcatSpreadable", symbolIsConcatSpreadable
-]);
-
 %FunctionSetLength(ArrayCopyWithin, 2);
 %FunctionSetLength(ArrayFrom, 1);
 %FunctionSetLength(ArrayFill, 1);

src/harmony-concat-spreadable.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function(global, utils) {
+
+'use strict';
+
+%CheckIsBootstrapping();
+
+utils.InstallConstants(global.Symbol, [
+  // TODO(littledan): Move to symbol.js when shipping
+  "isConcatSpreadable", symbolIsConcatSpreadable
+]);
+
+})

src/runtime/runtime-array.cc

@@ -729,13 +729,15 @@ static bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
 static bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
   HandleScope handle_scope(isolate);
   if (!obj->IsSpecObject()) return false;
-  Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
-  Handle<Object> value;
-  MaybeHandle<Object> maybeValue =
-      i::Runtime::GetObjectProperty(isolate, obj, key);
-  if (maybeValue.ToHandle(&value)) {
-    if (!value->IsUndefined()) {
-      return value->BooleanValue();
+  if (FLAG_harmony_concat_spreadable) {
+    Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
+    Handle<Object> value;
+    MaybeHandle<Object> maybeValue =
+        i::Runtime::GetObjectProperty(isolate, obj, key);
+    if (maybeValue.ToHandle(&value)) {
+      if (!value->IsUndefined()) {
+        return value->BooleanValue();
+      }
     }
   }
   return obj->IsJSArray();

test/mjsunit/harmony/array-concat.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-arrays
+// Flags: --harmony-concat-spreadable
 
 (function testArrayConcatArity() {
   "use strict";

tools/gyp/v8.gyp

@@ -1786,6 +1786,7 @@
           '../../src/generator.js',
           '../../src/harmony-atomics.js',
           '../../src/harmony-array-includes.js',
+          '../../src/harmony-concat-spreadable.js',
           '../../src/harmony-tostring.js',
           '../../src/harmony-regexp.js',
           '../../src/harmony-reflect.js',