Version 4.6.85.19 (cherry-pick)

Merged f44efd6

Fix spread operator in ArrayLiterals when nested in other literals

BUG=v8:4417
LOG=N
R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1356913005 .

Cr-Commit-Position: refs/branch-heads/4.6@{#22}
Cr-Branched-From: 24d34a8-refs/heads/4.6.85@{#1}
Cr-Branched-From: 8f44118-refs/heads/master@{#30256}

include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 4
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 85
-#define V8_PATCH_LEVEL 18
+#define V8_PATCH_LEVEL 19
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

src/ast.cc

@@ -520,7 +520,7 @@ void ArrayLiteral::BuildConstantElements(Isolate* isolate) {
       Strength::WEAK, INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE);
 
   // Fill in the literals.
-  bool is_simple = true;
+  bool is_simple = (first_spread_index_ < 0);
   int depth_acc = 1;
   bool is_holey = false;
   int array_index = 0;

test/mjsunit/harmony/regress/regress-4417.js

@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-spread-arrays
+
+var arr = [1, 2, 3];
+assertEquals({arr: [1, 2, 3]}, {arr: [...arr]});
+assertEquals([[1, 2, 3]], [[...arr]]);
+
+assertEquals({arr: [6, 5, [1, 2, 3]]}, {arr: [6, 5, [...arr]]});
+assertEquals([8, 7, [6, 5, [1, 2, 3]]], [8, 7, [6, 5, [...arr]]]);