Fix wrongly handled exception in CheckProxyHasTrap

Bug: chromium:760268
Change-Id: Id9b24ddee61926a5d1324d7da12efccf2c1eb9c2
Reviewed-on: https://chromium-review.googlesource.com/642798Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#47704}

src/runtime/runtime-proxy.cc

@@ -78,10 +78,9 @@ RUNTIME_FUNCTION(Runtime_CheckProxyHasTrap) {
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 1);
 
-  RETURN_ON_SCHEDULED_EXCEPTION_VALUE(
-      isolate, JSProxy::CheckHasTrap(isolate, name, target),
-      *isolate->factory()->undefined_value());
-  return *isolate->factory()->undefined_value();
+  Maybe<bool> result = JSProxy::CheckHasTrap(isolate, name, target);
+  if (!result.IsJust()) return isolate->heap()->exception();
+  return isolate->heap()->ToBoolean(result.FromJust());
 }
 
 }  // namespace internal

test/mjsunit/regress/regress-760268.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = this;
+var handler = {
+  has: function() { return false; }
+}
+var proxy = new Proxy(obj, handler);
+Object.defineProperty(obj, "nonconf", {});
+assertThrows("'nonconf' in proxy");