[proxies] Make Array.prototype.concat work correctly with proxies.

test/mjsunit/harmony/proxies-json.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 403 matching lines @@
 
 var getTrap = function(t, key) {
   if (key === "length") return Symbol();
   if (key === "2") return "baz";
   if (key === "3") return "bar";
 };
 var target = [];
 var proxy = new Proxy(target, {get: getTrap});
 var replacer = (key, val) => key === "goo" ? proxy : val;
 var object = {foo: true, goo: false};
-assertThrows(() => JSON.stringify(object, replacer));
+assertThrows(() => JSON.stringify(object, replacer), TypeError);
 
 
 // Replacer returns a callable proxy
 
 log.length = 0;
 var target = () => 666;
 var proxy = new Proxy(target, handler);
 var replacer = (key, val) => key === "1" ? proxy : val;
 
 assertEquals('["foo",null]', JSON.stringify(["foo", 42], replacer));
@@ skipping 66 matching lines @@
 
 var result = JSON.parse('{"foo":0,"bar":1}', reviver);
 assertEquals({foo: 0, bar: proxy}, result);
 assertSame(result.bar, proxy);
 assertEquals(3, log.length);
 for (var i in log) assertSame(target, log[i][1]);
 
 assertEquals(["get", target, "length", proxy], log[0]);
 assertEquals(["get", target, "0", proxy], log[1]);
 assertEquals(["deleteProperty", target, "0"], log[2]);