Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject.

BUG=chromium:583260
LOG=n

Review URL: https://codereview.chromium.org/1664683002

Cr-Commit-Position: refs/heads/master@{#33697}

src/runtime/runtime-scopes.cc

@@ -979,10 +979,10 @@ RUNTIME_FUNCTION(Runtime_DeleteLookupSlot) {
     return isolate->heap()->false_value();
   }
 
-  // The slot was found in a JSObject, either a context extension object,
+  // The slot was found in a JSReceiver, either a context extension object,
   // the global object, or the subject of a with.  Try to delete it
   // (respecting DONT_DELETE).
-  Handle<JSObject> object = Handle<JSObject>::cast(holder);
+  Handle<JSReceiver> object = Handle<JSReceiver>::cast(holder);
   Maybe<bool> result = JSReceiver::DeleteProperty(object, name);
   MAYBE_RETURN(result, isolate->heap()->exception());
   return isolate->heap()->ToBoolean(result.FromJust());

test/mjsunit/mjsunit.status

@@ -760,6 +760,7 @@
   'regress/regress-1528': [FAIL],
   'regress/regress-2594': [FAIL],
   'regress/regress-410030': [FAIL],
+  'regress/regress-583260': [FAIL],
   'regress/regress-96523': [FAIL],
   'regress/regress-crbug-505907': [FAIL],
   'regress/regress-crbug-506956': [FAIL],

test/mjsunit/regress/regress-583260.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_1 = {
+  has() { return true }
+};
+__v_2 = new Proxy({}, __v_1);
+function __f_5(object) {
+  with (object) { return delete __v_3; }
+}
+ __f_5(__v_2)