[runtime] Pass in receiver as target to the LookupIterator if known to be JSReceiver

src/property-descriptor.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/property-descriptor.h"
 
 #include "src/bootstrapper.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
@@ skipping 87 matching lines @@
       (desc->has_value() || desc->has_writable())) {
     // Bail out to slow path to throw an exception.
     return false;
   }
   return true;
 }
 
 
 void CreateDataProperty(Isolate* isolate, Handle<JSObject> object,
                         Handle<String> name, Handle<Object> value) {
-  LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator it(object, name, object, LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<bool> result = JSObject::CreateDataProperty(&it, value);
   CHECK(result.IsJust() && result.FromJust());
 }
 
 }  // namespace
 
 
 // ES6 6.2.4.4 "FromPropertyDescriptor"
 Handle<Object> PropertyDescriptor::ToObject(Isolate* isolate) {
   DCHECK(!(PropertyDescriptor::IsAccessorDescriptor(this) &&
@@ skipping 206 matching lines @@
   //    Desc.[[Enumerable]] to like.[[Enumerable]].
   if (!desc->has_enumerable()) desc->set_enumerable(false);
   // 7. If Desc does not have a [[Configurable]] field, set
   //    Desc.[[Configurable]] to like.[[Configurable]].
   if (!desc->has_configurable()) desc->set_configurable(false);
   // 8. Return Desc.
 }
 
 }  // namespace internal
 }  // namespace v8