Ensure JSProxy correctness for PrototypeIterator uses

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index bab706e12730f0f93af71dab5422220c76f219ef..5b20fcd3784300cfdb0271f26184a911e9751091 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1083,6 +1083,14 @@ bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
       break;
     }
     case DICTIONARY_ELEMENTS: {
+      // CollectElementIndices() can't be called when there's a JSProxy
+      // on the prototype chain.
+      for (PrototypeIterator iter(isolate, receiver); !iter.IsAtEnd();
+           iter.Advance()) {
+        if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
+          return IterateElementsSlow(isolate, receiver, length, visitor);
+        }
+      }
       Handle<SeededNumberDictionary> dict(receiver->element_dictionary());
       List<uint32_t> indices(dict->Capacity() / 2);
       // Collect all indices in the object and the prototypes less