[proxies] Fix bogus cast in HasOwnPropertyImplementation

test/mjsunit/harmony/proxies-has.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-proxies
 
 var target = {
   "target_one": 1
 };
 target.__proto__ = {
@@ skipping 36 matching lines @@
 result = false;
 assertThrows("'nonconf' in proxy", TypeError);
 
 // Step 9b iii. Trap result must confirm presence of all own properties of
 // non-extensible targets.
 Object.preventExtensions(target);
 assertThrows("'nonconf' in proxy", TypeError);
 assertThrows("'target_one' in proxy", TypeError);
 assertFalse("target_two" in proxy);
 assertFalse("in_your_dreams" in proxy);
+
+// Regression test for crbug.com/570120 (stray JSObject::cast).
+(function TestHasPropertyFastPath() {
+  var proxy = new Proxy({}, {});
+  var object = Object.create(proxy);
+  object.hasOwnProperty(0);
+})();