[proxies] Fix bogus cast in HasOwnPropertyImplementation

test/mjsunit/harmony/proxies-has.js

Index: test/mjsunit/harmony/proxies-has.js
diff --git a/test/mjsunit/harmony/proxies-has.js b/test/mjsunit/harmony/proxies-has.js
index 1c1e98d5b15d1b80f9a2d3cb3e0289eae58139dc..b7848e8ae3fa41f115de48ba0491770b9d2e3323 100644
--- a/test/mjsunit/harmony/proxies-has.js
+++ b/test/mjsunit/harmony/proxies-has.js
@@ -54,3 +54,10 @@ assertThrows("'nonconf' in proxy", TypeError);
 assertThrows("'target_one' in proxy", TypeError);
 assertFalse("target_two" in proxy);
 assertFalse("in_your_dreams" in proxy);
+
+// Regression test for crbug.com/570120 (stray JSObject::cast).
+(function TestHasPropertyFastPath() {
+  var proxy = new Proxy({}, {});
+  var object = Object.create(proxy);
+  object.hasOwnProperty(0);
+})();