Version 4.8.135.3 (cherry-pick)

src/property-descriptor.cc

Index: src/property-descriptor.cc
diff --git a/src/property-descriptor.cc b/src/property-descriptor.cc
index 2ecf75a74e593f37587ffb337d81bbe4e8b3dd68..442d056a1c081a6ca22b78ccbfcd5ef8dc056dbc 100644
--- a/src/property-descriptor.cc
+++ b/src/property-descriptor.cc
@@ -4,7 +4,6 @@
 
 #include "src/property-descriptor.h"
 
-#include "src/bootstrapper.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
@@ -44,9 +43,6 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<Object> obj,
   if (map->instance_type() != JS_OBJECT_TYPE) return false;
   if (map->is_access_check_needed()) return false;
   if (map->prototype() != *isolate->initial_object_prototype()) return false;
-  // During bootstrapping, the object_function_prototype_map hasn't been
-  // set up yet.
-  if (isolate->bootstrapper()->IsActive()) return false;
   if (JSObject::cast(map->prototype())->map() !=
       isolate->native_context()->object_function_prototype_map()) {
     return false;
@@ -214,11 +210,7 @@ bool PropertyDescriptor::ToPropertyDescriptor(Isolate* isolate,
     }
   } else {
     DCHECK(obj->IsJSProxy());
-    // Having an UNIMPLEMENTED() here would upset ClusterFuzz, because
-    // --harmony-proxies makes it possible to reach this branch.
-    isolate->Throw(
-        *isolate->factory()->NewTypeError(MessageTemplate::kUnsupported));
-    return false;
+    UNIMPLEMENTED();
   }
   // 23. Return desc.
   return true;