[proxies] Fix JSObject::AllCanRead for Proxies on the prototype chain

Review URL: https://codereview.chromium.org/1517753003

Cr-Commit-Position: refs/heads/master@{#32805}

src/objects.cc

@@ -1188,6 +1188,9 @@ bool JSObject::AllCanRead(LookupIterator* it) {
       }
     } else if (it->state() == LookupIterator::INTERCEPTOR) {
       if (it->GetInterceptor()->all_can_read()) return true;
+    } else if (it->state() == LookupIterator::JSPROXY) {
+      // Stop lookupiterating. And no, AllCanNotRead.
+      return false;
     }
   }
   return false;

test/mjsunit/harmony/proxies-accesschecks.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-proxies
+
+var realm = Realm.create();
+
+this.__proto__ = new Proxy({}, {
+  getPrototypeOf() { assertUnreachable() },
+  get() { assertUnreachable() }
+});
+
+var other_type_error = Realm.eval(realm, "TypeError");
+assertThrows(() => Realm.eval(realm, "Realm.global(0).foo"), other_type_error);