Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject.

GeorgNeis · Commit bot · commit a973f734657f · 2016-02-03T09:49:22.000Z
BUG=chromium:583260 LOG=n Review URL: https://codereview.chromium.org/1664683002 Cr-Commit-Position: refs/heads/master@{#33697}
diff --git a/src/runtime/runtime-scopes.cc b/src/runtime/runtime-scopes.cc
@@ -979,10 +979,10 @@ RUNTIME_FUNCTION(Runtime_DeleteLookupSlot) {
     return isolate->heap()->false_value();
   }
 
-  // The slot was found in a JSObject, either a context extension object,
+  // The slot was found in a JSReceiver, either a context extension object,
   // the global object, or the subject of a with.  Try to delete it
   // (respecting DONT_DELETE).
-  Handle<JSObject> object = Handle<JSObject>::cast(holder);
+  Handle<JSReceiver> object = Handle<JSReceiver>::cast(holder);
   Maybe<bool> result = JSReceiver::DeleteProperty(object, name);
   MAYBE_RETURN(result, isolate->heap()->exception());
   return isolate->heap()->ToBoolean(result.FromJust());
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
@@ -760,6 +760,7 @@
   'regress/regress-1528': [FAIL],
   'regress/regress-2594': [FAIL],
   'regress/regress-410030': [FAIL],
+  'regress/regress-583260': [FAIL],
   'regress/regress-96523': [FAIL],
   'regress/regress-crbug-505907': [FAIL],
   'regress/regress-crbug-506956': [FAIL],
diff --git a/test/mjsunit/regress/regress-583260.js b/test/mjsunit/regress/regress-583260.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_1 = {
+  has() { return true }
+};
+__v_2 = new Proxy({}, __v_1);
+function __f_5(object) {
+  with (object) { return delete __v_3; }
+}
+ __f_5(__v_2)
