[proxy] fix has trap check for indices

sigatrev · Commit Bot · commit 11d83586fa07 · 2019-03-11T20:53:47.000Z
Bug: chromium:937618 Change-Id: I360013d1e99e7e54f4bb942b1f8f4918f81d525d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1510333 Commit-Queue: Matt Gardner <magardn@microsoft.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#60173}
diff --git a/src/builtins/builtins-proxy-gen.cc b/src/builtins/builtins-proxy-gen.cc
@@ -738,11 +738,18 @@ void ProxiesCodeStubAssembler::CheckHasTrapResult(Node* context, Node* target,
   VARIABLE(var_details, MachineRepresentation::kWord32);
   VARIABLE(var_raw_value, MachineRepresentation::kTagged);
 
-  Label if_found_value(this, Label::kDeferred),
+  Label if_unique_name(this), if_found_value(this, Label::kDeferred),
       throw_non_configurable(this, Label::kDeferred),
       throw_non_extensible(this, Label::kDeferred);
 
+  // If the name is a unique name, bailout to the runtime.
+  VARIABLE(var_index, MachineType::PointerRepresentation(), IntPtrConstant(0));
+  VARIABLE(var_name, MachineRepresentation::kTagged);
+  TryToName(name, if_bailout, &var_index, &if_unique_name, &var_name,
+            if_bailout);
+
   // 9.a. Let targetDesc be ? target.[[GetOwnProperty]](P).
+  BIND(&if_unique_name);
   Node* instance_type = LoadInstanceType(target);
   TryGetOwnProperty(context, target, target, target_map, instance_type, name,
                     &if_found_value, &var_value, &var_details, &var_raw_value,
diff --git a/test/mjsunit/regress/regress-crbug-937618.js b/test/mjsunit/regress/regress-crbug-937618.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let target = {0:42, a:42};
+
+let proxy = new Proxy(target, {
+  has: function() { return false; },
+});
+
+Object.preventExtensions(target);
+
+function testLookupElementInProxy() {
+  0 in proxy;
+}
+
+// 9.5.7 [[HasProperty]] 9. states that if the trap returns false, and the
+// target hasOwnProperty, and the target is non-extensible, throw a type error.
+
+assertThrows(testLookupElementInProxy, TypeError);
+assertThrows(testLookupElementInProxy, TypeError);
+%OptimizeFunctionOnNextCall(testLookupElementInProxy);
+assertThrows(testLookupElementInProxy, TypeError);
+
+function testLookupPropertyInProxy(){
+  "a" in proxy;
+}
+
+assertThrows(testLookupPropertyInProxy, TypeError);
+assertThrows(testLookupPropertyInProxy, TypeError);
+%OptimizeFunctionOnNextCall(testLookupPropertyInProxy);
+assertThrows(testLookupPropertyInProxy, TypeError);
