[builtins] take slow path in IsConcatSpreadable if proxy in prototype

src/isolate.cc

Index: src/isolate.cc
diff --git a/src/isolate.cc b/src/isolate.cc
index adf180db06c7c16e506d0ab83a4b3f5f5202b233..7ce82cde9161d5f95adc64e45b7906eb5d2c4ad1 100644
--- a/src/isolate.cc
+++ b/src/isolate.cc
@@ -2659,6 +2659,11 @@ bool Isolate::IsIsConcatSpreadableLookupChainIntact() {
   return !is_is_concat_spreadable_set;
 }
 
+bool Isolate::IsIsConcatSpreadableLookupChainIntact(JSReceiver* receiver) {
+  if (!IsIsConcatSpreadableLookupChainIntact()) return false;
+  return !receiver->HasProxyInPrototype(this);
+}
+
 void Isolate::UpdateArrayProtectorOnSetElement(Handle<JSObject> object) {
   DisallowHeapAllocation no_gc;
   if (!object->map()->is_prototype_map()) return;