[es6] Support optional "receiver" argument in Reflect.get.

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 54d190169103708c0cdb20e44cd53b68ab00cc54..c97cb584f340e195e661611d320143624c405d44 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1474,14 +1474,10 @@ BUILTIN(ReflectDeleteProperty) {
 // ES6 section 26.1.6 Reflect.get
 BUILTIN(ReflectGet) {
   HandleScope scope(isolate);
-  DCHECK_LE(3, args.length());
-  DCHECK_LE(args.length(), 4);
-  Handle<Object> target = args.at<Object>(1);
-  Handle<Object> key = args.at<Object>(2);
-  // Handle<Object> receiver = args.length() == 4 ? args.at<Object>(3) : target;
-  //
-  // TODO(neis): We ignore the receiver argument for now because
-  // GetPropertyOrElement doesn't support it yet.
+  Handle<Object> undef = isolate->factory()->undefined_value();
+  Handle<Object> target = args.length() > 1 ? args.at<Object>(1) : undef;
+  Handle<Object> key = args.length() > 2 ? args.at<Object>(2) : undef;
+  Handle<Object> receiver = args.length() > 3 ? args.at<Object>(3) : target;
 
   if (!target->IsJSReceiver()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -1496,7 +1492,8 @@ BUILTIN(ReflectGet) {
 
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result, Object::GetPropertyOrElement(target, name));
+      isolate, result, Object::GetPropertyOrElement(
+          Handle<JSReceiver>::cast(target), name, receiver));
 
   return *result;
 }