[builtins] take slow path in IsConcatSpreadable if proxy in prototype

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 503354cd373fcb69e04ee01637df8d374e241191..6181ed63f901192dff68bc1861120359368d2af8 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -18986,5 +18986,14 @@ AccessCheckInfo* AccessCheckInfo::Get(Isolate* isolate,
   return AccessCheckInfo::cast(data_obj);
 }
 
+bool JSReceiver::HasProxyInPrototype(Isolate* isolate) {
+  for (PrototypeIterator iter(isolate, this, kStartAtReceiver,
+                              PrototypeIterator::END_AT_NULL);
+       !iter.IsAtEnd(); iter.AdvanceIgnoringProxies()) {
+    if (iter.GetCurrent<Object>()->IsJSProxy()) return true;
+  }
+  return false;
+}
+
 }  // namespace internal
 }  // namespace v8