[JSC] Fix Array.prototype.concat fast case when single argument is Proxy
https://bugs.webkit.org/show_bug.cgi?id=184267
Reviewed by Saam Barati.
JSTests:
* stress/array-concat-fast-spread-proxy.js: Copied from JSTests/stress/array-concat-spread-proxy.js.
(arrayEq):
(catch):
* stress/array-concat-spread-proxy.js:
Source/JavaScriptCore:
Before this patch, the fast case for Array.prototype.concat was taken if
there was a single argument passed to the function, which is either a
non-JSCell, or an ObjectType JSCell not marked as concat-spreadable.
This incorrectly prevented Proxy objects from being spread when
they were the only argument passed to A.prototype.concat(), violating ECMA-262.
* builtins/ArrayPrototype.js:
(concat):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232261
268f45cc-cd09-0410-ab3c-
d52691b4dbfc