[builtins] take slow path in IsConcatSpreadable if proxy in prototype

test/mjsunit/es6/array-concat.js

Index: test/mjsunit/es6/array-concat.js
diff --git a/test/mjsunit/es6/array-concat.js b/test/mjsunit/es6/array-concat.js
index 00edfd66c1c52466113f7ef649d40fe209ea9d29..393a65a12227ceaa303bafffbc7b9ff8a949ebc8 100644
--- a/test/mjsunit/es6/array-concat.js
+++ b/test/mjsunit/es6/array-concat.js
@@ -872,3 +872,24 @@ logger.get = function(t, trap, r) {
   assertThrows(() => [].concat(obj), TypeError);
   assertThrows(() => Array.prototype.concat.apply(obj), TypeError);
 })();
+
+(function testConcatRevokedProxy() {
+  "use strict";
+  var target = [];
+  var handler = {
+    get(_, name) {
+      if (name === Symbol.isConcatSpreadable) {
+        p.revoke();
+      }
+      return target[name];
+    }
+  }
+
+  var p = Proxy.revocable(target, handler);
+  assertThrows(function() { [].concat(p.proxy); }, TypeError);
+
+  p = Proxy.revocable(target, handler);
+  target = {};
+  target.__proto__ = p.proxy;
+  assertThrows(function() { [].concat({ __proto__: p.proxy }); }, TypeError);

[neis, 2016/07/11 09:25:19]

Unfortunately the test file is a bit screwed up: this version passes even
without your code change.  The reason is that the protector thingie gets already
invalidated in one of the earlier test functions, so the problematic path won't
get tested.  Not sure right now how to fix this other than moving the new test
to the top.

[caitp, 2016/07/11 11:12:08]

Thanks for the info, will do

+})();