Inconsistent output compared with other JS engines

Hello,
The following code behaves incorrectly (inconsistent with the standard and other engines).

arr0 = [ 1, 2, 3 ];                                                                                                                 
 arr1 = [ 4, 5, 6 ];  
handler1 = { 
    get: function (oTarget, sKey) {
       print('arg ' + '1' + ':get ' + sKey.toString()); 
       if (sKey.toString() == 'Symbol(Symbol.isConcatSpreadable)') { 
          arr0[1] = { undefined: 'a', 1: 'b', 2: 'c' };  
       }   
       if (sKey.toString() == 'length') { 
          arr1['length'] = 100; return 10; 
       }   
       if (Number(sKey.toString()) != NaN) { ; } 
       return Reflect.get(oTarget, sKey);
   },  
   has: function (oTarget, sKey) { 
      print('arg ' + '1' + ':has ' + sKey.toString()); 
      if (Number(sKey.toString()) != NaN) {
           arr1[1] = true; return Symbol.split;
      }   
      return Reflect.has(oTarget, sKey); } 
   };  
var proxy1 = new Proxy(arr1, handler1); 
arr2 = Array.prototype.concat.call(arr0, proxy1); 
print(arr2);

The output is :
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get Symbol(Symbol.toPrimitive)
arg 1:get toString
arg 1:get join
arg 1:get length
arg 1:get 0
arg 1:get 1
arg 1:get 2
arg 1:get 3
arg 1:get 4
arg 1:get 5
arg 1:get 6
arg 1:get 7
arg 1:get 8
arg 1:get 9
1,[object Object],3,4,5,6,,,,,,,

However, it should be:
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get length
arg 1:has 0
arg 1:get 0
arg 1:has 1
arg 1:get 1
arg 1:has 2
arg 1:get 2
arg 1:has 3
arg 1:get 3
arg 1:has 4
arg 1:get 4
arg 1:has 5
arg 1:get 5
arg 1:has 6
arg 1:get 6
arg 1:has 7
arg 1:get 7
arg 1:has 8
arg 1:get 8
arg 1:has 9
arg 1:get 9
1,2,3,4,true,6,,,,,,,

[Alexey Shvayka]

(In reply to sunlili from comment #0)
> However, it should be:
> arg 1:get Symbol(Symbol.isConcatSpreadable)
> arg 1:get length

Thank you for detailed reports.
As of r232261, JSC outputs as expected.

*** This bug has been marked as a duplicate of bug 184267 ***