[builtins] Fix Array.prototype.concat bug

test/mjsunit/array-concat.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 11 matching lines @@
 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 /**
  * @fileoverview Test concat on small and large arrays
  */
 
+
+(function testStringWrapperConcat() {
+  var concat = Array.prototype.concat;
+  var str = new String('abcd');
+  assertEquals([1,2,3,new String('abcd')], [1, 2, 3].concat(str));
+  assertEquals([new String("abcd")], concat.call(str));
+
+  var array = [1, 2, 3];
+  array.__proto__ = str;
+  array.length = 4;
+  assertEquals([1,2,3,'d'], concat.call(array));
+})()
+
 var poses;
 
 poses = [140, 4000000000];
 while (pos = poses.shift()) {
   var a = new Array(pos);
   var array_proto = [];
   a.__proto__ = array_proto;
   assertEquals(pos, a.length);
   a.push('foo');
   assertEquals(pos + 1, a.length);
@@ skipping 186 matching lines @@
 function mkGetter(i) { return function() { trace.push(i); }; }
 arr3.length = 10000;
 for (var i = 0; i < 100; i++) {
   Object.defineProperty(arr3, i * i, {get: mkGetter(i)});
   expectedTrace[i] = i;
   expectedTrace[100 + i] = i;
 }
 var r4 = [0].concat(arr3, arr3);
 assertEquals(1 + arr3.length * 2, r4.length);
 assertEquals(expectedTrace, trace);