GCExtension: Bail out on proxy parameter

Bug: chromium:1006640
Change-Id: I0f38ed9c44b6a2a6cfd52fdd9e177768f57beb11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1833692
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64077}

src/extensions/gc-extension.cc

@@ -42,7 +42,7 @@ GCOptions Parse(v8::Isolate* isolate, v8::Local<v8::Context> ctx,
                 ExecutionType::kSync};
   bool found_options_object = false;
 
-  if (args[0]->IsObject()) {
+  if (args[0]->IsObject() && !args[0]->IsProxy()) {
     auto param = v8::Local<v8::Object>::Cast(args[0]);
     if (IsProperty(isolate, ctx, param, "type", "minor")) {
       found_options_object = true;

test/mjsunit/regress/regress-1002827.js

-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-gc
-
-var PI = new Proxy(this, {
-    get() {
-        PI();
-    }
-});
-
-assertThrows(() => new gc(PI, {}), TypeError);