[builtins] Fix crash in ProxyHasProperty stub

The crash used to happen when trap is a Smi.

Bug: chromium:756608
Change-Id: I0a6f0328afc64d8e521b5b370a291f9aef6b08d0
Reviewed-on: https://chromium-review.googlesource.com/620647Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#47429}

src/builtins/builtins-proxy-gen.cc

@@ -279,6 +279,7 @@ TF_BUILTIN(ProxyHasProperty, ProxiesCodeStubAssembler) {
   Handle<Name> trap_name = factory()->has_string();
   Node* trap = GetMethod(context, handler, trap_name, &trap_undefined);
 
+  GotoIf(TaggedIsSmi(trap), &trap_not_callable);
   GotoIfNot(IsCallable(trap), &trap_not_callable);
 
   // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler, « target, P

test/mjsunit/regress/regress-756608.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() {
+  'foo' in new Proxy({}, {has: 0});
+}, TypeError);