Fix a prototype chain traversal not expecting proxies.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index d3cb8b5ee20d52de8193ade6e9e256666d357f2d..b4db9e5605a9212851a4b46cd4fbefadde2d8685 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3995,7 +3995,7 @@ void JSReceiver::Lookup(String* name, LookupResult* result) {
 void JSObject::LookupCallback(String* name, LookupResult* result) {
   Heap* heap = GetHeap();
   for (Object* current = this;
-       current != heap->null_value();
+       current != heap->null_value() && current->IsJSObject();
        current = JSObject::cast(current)->GetPrototype()) {
     JSObject::cast(current)->LocalLookupRealNamedProperty(name, result);
     if (result->IsProperty() && result->type() == CALLBACKS) return;