X87: [proxies] throw TypeError if is_callable Map bit is unset.

  port 18b9c1ce (r34461)

  original commit message:
  Per ProxyCreate() (https://tc39.github.io/ecma262/#sec-proxycreate), a Proxy
  is only given a [[Call]] slot if the target has a [[Call]] slot as well. This
  was previously implemented correctly for [[Construct]], but not for [[Call]].

BUG=

Review URL: https://codereview.chromium.org/1754593007

Cr-Commit-Position: refs/heads/master@{#34478}

src/x87/builtins-x87.cc

@@ -2228,6 +2228,11 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode,
   __ CmpInstanceType(ecx, JS_BOUND_FUNCTION_TYPE);
   __ j(equal, masm->isolate()->builtins()->CallBoundFunction(tail_call_mode),
        RelocInfo::CODE_TARGET);
+
+  // Check if target has a [[Call]] internal method.
+  __ test_b(FieldOperand(ecx, Map::kBitFieldOffset), 1 << Map::kIsCallable);
+  __ j(zero, &non_callable);
+
   __ CmpInstanceType(ecx, JS_PROXY_TYPE);
   __ j(not_equal, &non_function);
 
@@ -2250,9 +2255,6 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode,
   // 2. Call to something else, which might have a [[Call]] internal method (if
   // not we raise an exception).
   __ bind(&non_function);
-  // Check if target has a [[Call]] internal method.
-  __ test_b(FieldOperand(ecx, Map::kBitFieldOffset), 1 << Map::kIsCallable);
-  __ j(zero, &non_callable, Label::kNear);
   // Overwrite the original receiver with the (original) target.
   __ mov(Operand(esp, eax, times_pointer_size, kPointerSize), edi);
   // Let the "call_as_function_delegate" take care of the rest.