Fix issue with setting __proto__ on a value

LOG=N
BUG=v8:3172
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/174113003

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/v8natives.js

@@ -1394,7 +1394,7 @@ function ObjectGetProto() {
 function ObjectSetProto(proto) {
   CHECK_OBJECT_COERCIBLE(this, "Object.prototype.__proto__");
 
-  if (IS_SPEC_OBJECT(proto) || IS_NULL(proto) && IS_SPEC_OBJECT(this)) {
+  if ((IS_SPEC_OBJECT(proto) || IS_NULL(proto)) && IS_SPEC_OBJECT(this)) {
     %SetPrototype(this, proto);
   }
 }

test/mjsunit/proto-accessor.js

@@ -102,12 +102,13 @@ var values = [1, true, false, 's', Symbol()];
 
 
 function TestSetProtoOfValues() {
+  var proto = {};
   for (var i = 0; i < values.length; i++) {
-    assertEquals(setProto.call(values[i], i), undefined);
+    assertEquals(setProto.call(values[i], proto), undefined);
   }
 
-  assertThrows(function() { setProto.call(null, 7); }, TypeError);
-  assertThrows(function() { setProto.call(undefined, 8); }, TypeError);
+  assertThrows(function() { setProto.call(null, proto); }, TypeError);
+  assertThrows(function() { setProto.call(undefined, proto); }, TypeError);
 }
 TestSetProtoOfValues();