Version 5.3.332.20 (cherry-pick)

Merged 08d0012

[keys] propagate PropertyFilter to proxy targets in KeyAccumulator

BUG=v8:1543,v8:5174
LOG=N
R=littledan@chromium.org

Review URL: https://codereview.chromium.org/2168683002 .

Cr-Commit-Position: refs/branch-heads/5.3@{#24}
Cr-Branched-From: 820a23a-refs/heads/5.3.332@{#2}
Cr-Branched-From: 37538cb-refs/heads/master@{#37308}

include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 3
 #define V8_BUILD_NUMBER 332
-#define V8_PATCH_LEVEL 19
+#define V8_PATCH_LEVEL 20
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

src/keys.cc

@@ -785,7 +785,11 @@ Maybe<bool> KeyAccumulator::CollectOwnJSProxyTargetKeys(
   // TODO(cbruni): avoid creating another KeyAccumulator
   Handle<FixedArray> keys;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate_, keys, JSReceiver::OwnPropertyKeys(target), Nothing<bool>());
+      isolate_, keys,
+      KeyAccumulator::GetKeys(target, KeyCollectionMode::kOwnOnly, filter_,
+                              GetKeysConversion::kConvertToString,
+                              filter_proxy_keys_, is_for_in_),
+      Nothing<bool>());
   bool prev_filter_proxy_keys_ = filter_proxy_keys_;
   filter_proxy_keys_ = false;
   Maybe<bool> result = AddKeysFromJSProxy(proxy, keys);

src/objects.cc

@@ -8359,11 +8359,13 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
 
   PropertyFilter key_filter =
       static_cast<PropertyFilter>(filter & ~ONLY_ENUMERABLE);
-  KeyAccumulator accumulator(isolate, KeyCollectionMode::kOwnOnly, key_filter);
-  MAYBE_RETURN(accumulator.CollectKeys(object, object),
-               MaybeHandle<FixedArray>());
-  Handle<FixedArray> keys =
-      accumulator.GetKeys(GetKeysConversion::kConvertToString);
+
+  Handle<FixedArray> keys;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, keys,
+      KeyAccumulator::GetKeys(object, KeyCollectionMode::kOwnOnly, key_filter,
+                              GetKeysConversion::kConvertToString),
+      MaybeHandle<FixedArray>());
 
   values_or_entries = isolate->factory()->NewFixedArray(keys->length());
   int length = 0;

test/mjsunit/es6/proxies-keys.js

@@ -48,3 +48,31 @@ assertEquals(["target"], Object.keys(proxy2));
   assertEquals(["1","2"], Object.getOwnPropertyNames(p));
   assertEquals([symbol], Object.getOwnPropertySymbols(p));
 })();
+
+(function testNoProxyTraps() {
+  var test_sym = Symbol("sym1");
+  var test_sym2 = Symbol("sym2");
+  var target = {
+    one: 1,
+    two: 2,
+    [test_sym]: 4,
+    0: 0,
+  };
+  Object.defineProperty(
+      target, "non-enum",
+      { enumerable: false, value: "nope", configurable: true, writable: true });
+  target.__proto__ = {
+    target_proto: 3,
+    1: 1,
+    [test_sym2]: 5
+  };
+  Object.defineProperty(
+      target.__proto__, "non-enum2",
+      { enumerable: false, value: "nope", configurable: true, writable: true });
+  var proxy = new Proxy(target, {});
+
+  assertEquals(["0", "one", "two"], Object.keys(proxy));
+  assertEquals(["0", "one", "two", "non-enum"],
+               Object.getOwnPropertyNames(proxy));
+  assertEquals([test_sym], Object.getOwnPropertySymbols(proxy));
+})();

test/mjsunit/regress/regress-5174.js

@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+
+assertEquals([], Object.keys(new Proxy([], {})));
+assertEquals([], Object.keys(new Proxy(/regex/, {})));