Ensure JSProxy correctness for PrototypeIterator uses

src/ic/handler-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/handler-compiler.h"
 
 #include "src/ic/call-optimization.h"
 #include "src/ic/ic.h"
 #include "src/ic/ic-inl.h"
 #include "src/isolate-inl.h"
@@ skipping 312 matching lines @@
   bool lost_holder_register = false;
   auto holder_orig = holder();
   // non masking interceptors must check the entire chain, so temporarily reset
   // the holder to be that last element for the FrontendHeader call.
   if (holder()->GetNamedInterceptor()->non_masking()) {
     DCHECK(!inline_followup);
     JSObject* last = *holder();
     PrototypeIterator iter(isolate(), last);
     while (!iter.IsAtEnd()) {
       lost_holder_register = true;
+      // Casting to JSObject is fine here. The LookupIterator makes sure to
+      // look behind non-masking interceptors during the original lookup, and
+      // we wouldn't try to compile a handler if there was a Proxy anywhere.
       last = iter.GetCurrent<JSObject>();
       iter.Advance();
     }
     auto last_handle = handle(last);
     set_holder(last_handle);
   }
   Register reg = FrontendHeader(receiver(), it->name(), &miss, RETURN_HOLDER);
   // Reset the holder so further calculations are correct.
   set_holder(holder_orig);
   if (lost_holder_register) {
@@ skipping 259 matching lines @@
                                                  : kNoExtraICState);
         cached_stub = LoadDictionaryElementStub(isolate(), state).GetCode();
       }
     }
 
     handlers->Add(cached_stub);
   }
 }
 }  // namespace internal
 }  // namespace v8