[builtins] take slow path in IsConcatSpreadable if proxy in prototype

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index b2159fade0ed4683b7f543b09757755b1cb37fda..8fe8fbc2c29173ba890abea1723820a4eeecfd93 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -18943,5 +18943,14 @@ AccessCheckInfo* AccessCheckInfo::Get(Isolate* isolate,
   return AccessCheckInfo::cast(data_obj);
 }
 
+bool JSReceiver::HasProxyInPrototype(Isolate* isolate) {
+  for (PrototypeIterator iter(isolate, this, kStartAtReceiver,
+                              PrototypeIterator::END_AT_NULL);
+       !iter.IsAtEnd(); iter.AdvanceIgnoringProxies()) {
+    if (iter.GetCurrent<Object>()->IsJSProxy()) return true;
+  }
+  return false;
+}
+
 }  // namespace internal
 }  // namespace v8