[builtins] Relax type check in a slow path of Object.assign.

Bug: chromium:851393
Change-Id: I53cbf16068efbf24a2bd233c0b4c56e8361f9931
Reviewed-on: https://chromium-review.googlesource.com/1104317Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53798}

src/runtime/runtime-object.cc

@@ -919,7 +919,7 @@ RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
 RUNTIME_FUNCTION(Runtime_SetDataProperties) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, source, 1);
 
   // 2. If source is undefined or null, let keys be an empty List.

test/mjsunit/regress/regress-crbug-851393.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proxy = new Proxy({}, {});
+
+Object.assign(proxy, { b: "boom", 060: "ah", o: "ouch" });