[builtins] take slow path in IsConcatSpreadable if proxy in prototype

test/mjsunit/es6/array-concat.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 (function testArrayConcatArity() {
   "use strict";
   assertEquals(1, Array.prototype.concat.length);
 })();
 
 
 (function testArrayConcatNoPrototype() {
@@ skipping 854 matching lines @@
     if (key === "length") return Symbol();
     if (key === "2") return "baz";
     if (key === "3") return "bar";
   };
   var target = [];
   var obj = new Proxy(target, {get: getTrap, has: () => true});
 
   assertThrows(() => [].concat(obj), TypeError);
   assertThrows(() => Array.prototype.concat.apply(obj), TypeError);
 })();
+
+(function testConcatRevokedProxy() {
+  "use strict";
+  var target = [];
+  var handler = {
+    get(_, name) {
+      if (name === Symbol.isConcatSpreadable) {
+        p.revoke();
+      }
+      return target[name];
+    }
+  }
+
+  var p = Proxy.revocable(target, handler);
+  assertThrows(function() { [].concat(p.proxy); }, TypeError);
+
+  p = Proxy.revocable(target, handler);
+  target = {};
+  target.__proto__ = p.proxy;
+  assertThrows(function() { [].concat({ __proto__: p.proxy }); }, TypeError);

[neis, 2016/07/11 09:25:19]

Unfortunately the test file is a bit screwed up: this version passes even
without your code change.  The reason is that the protector thingie gets already
invalidated in one of the earlier test functions, so the problematic path won't
get tested.  Not sure right now how to fix this other than moving the new test
to the top.

[caitp, 2016/07/11 11:12:08]

Thanks for the info, will do

+})();