[builtins] Fix Array.prototype.concat bug

test/mjsunit/array-concat.js

Index: test/mjsunit/array-concat.js
diff --git a/test/mjsunit/array-concat.js b/test/mjsunit/array-concat.js
index 97bd85aca2e646cd391558e0648458575d4e3c8b..6e25b5c5cd320c13dbbdeeb9fa0f6d5215a464fb 100644
--- a/test/mjsunit/array-concat.js
+++ b/test/mjsunit/array-concat.js
@@ -29,6 +29,19 @@
  * @fileoverview Test concat on small and large arrays
  */
 
+
+(function testStringWrapperConcat() {
+  var concat = Array.prototype.concat;
+  var str = new String('abcd');
+  assertEquals([1,2,3,new String('abcd')], [1, 2, 3].concat(str));
+  assertEquals([new String("abcd")], concat.call(str));
+
+  var array = [1, 2, 3];
+  array.__proto__ = str;
+  array.length = 4;
+  assertEquals([1,2,3,'d'], concat.call(array));
+})()
+
 var poses;
 
 poses = [140, 4000000000];