HasRealIndexedProperty doesn't work on JSGlobalProxy

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 2611b57aef1a6aae6f9efa3b137fab0a717d91c0..d533747c19596ee224037c47fdf3f69f2c089269 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3243,7 +3243,6 @@ void JSObject::LocalLookupRealNamedProperty(Name* name, LookupResult* result) {
     Object* proto = GetPrototype();
     if (proto->IsNull()) return result->NotFound();
     ASSERT(proto->IsJSGlobalObject());
-    // A GlobalProxy's prototype should always be a proper JSObject.
     return JSObject::cast(proto)->LocalLookupRealNamedProperty(name, result);
   }
 
@@ -12836,6 +12835,13 @@ bool JSObject::HasRealElementProperty(Isolate* isolate, uint32_t index) {
     }
   }
 
+  if (IsJSGlobalProxy()) {
+    Object* proto = GetPrototype();
+    if (proto->IsNull()) return false;
+    ASSERT(proto->IsJSGlobalObject());
+    return JSObject::cast(proto)->HasRealElementProperty(isolate, index);
+  }
+
   return GetElementAttributeWithoutInterceptor(this, index, false) != ABSENT;
 }