Interceptors expect the receiver to always be an JSReceiver.

test/cctest/test-api-interceptors.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #include "test/cctest/test-api.h"
 
 #include "include/v8-util.h"
 #include "src/api.h"
@@ skipping 3870 matching lines @@
       "var obj = intercepted_1;"
       "obj.x = 4;"
       "eval('obj.x');"
       "eval('obj.x');"
       "eval('obj.x');"
       "obj = intercepted_2;"
       "obj.x = 9;"
       "eval('obj.x');",
       9);
 }
+
+static void CheckReceiver(Local<Name> name,
+                          const v8::PropertyCallbackInfo<v8::Value>& info) {
+  CHECK(info.This()->IsObject());
+}
+
+TEST(Regress609134Interceptor) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  auto fun_templ = v8::FunctionTemplate::New(isolate);
+  fun_templ->InstanceTemplate()->SetHandler(
+      v8::NamedPropertyHandlerConfiguration(CheckReceiver));
+
+  CHECK(env->Global()
+            ->Set(env.local(), v8_str("Fun"),
+                  fun_templ->GetFunction(env.local()).ToLocalChecked())
+            .FromJust());
+
+  CompileRun(
+      "var f = new Fun();"
+      "Number.prototype.__proto__ = f;"
+      "var a = 42;"
+      "for (var i = 0; i<3; i++) { a.foo; }");
+}