[builtins] fix Object.fromEntries fast-path

Bug: chromium:1272026
Change-Id: Ic569c61b21d4c9c95d62e731a48076c871dd74ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3303804
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78119}

src/builtins/collections.tq

@@ -33,12 +33,9 @@ macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: JSAny):
         }
       }
     }
-    case (JSReceiver): {
+    case (JSAny): {
       goto MayHaveSideEffects;
     }
-    case (o: JSAny): deferred {
-      ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
-    }
   }
 }
 
@@ -48,6 +45,8 @@ transitioning macro LoadKeyValuePair(implicit context: Context)(o: JSAny):
   try {
     return LoadKeyValuePairNoSideEffects(o) otherwise Generic;
   } label Generic {
+    const o = Cast<JSReceiver>(o)
+        otherwise ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
     return KeyValuePair{
       key: GetProperty(o, Convert<Smi>(0)),
       value: GetProperty(o, Convert<Smi>(1))

test/mjsunit/regress/regress-crbug-1272026.js

@@ -0,0 +1,12 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let calledReturn = false;
+Object.prototype.return = function () {
+  calledReturn = true;
+};
+try {
+  Object.fromEntries([0]);
+} catch(e) {}
+assertEquals(true, calledReturn);