[classes] Properly handle static length computed property

Bug: chromium:913943
Change-Id: I2f7774ca1ea0a7855620a99d7e26cd764260129b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1538124
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60449}

src/objects/literal-objects.cc

@@ -255,9 +255,15 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
           }
         }
       } else {
-        // Overwrite existing value if it was defined before the computed one.
-        int existing_value_index = Smi::ToInt(existing_value);
-        if (existing_value_index < key_index) {
+        // Overwrite existing value if it was defined before the computed one
+        // (AccessorInfo "length" property is always defined before).
+        DCHECK_IMPLIES(!existing_value->IsSmi(),
+                       existing_value->IsAccessorInfo());
+        DCHECK_IMPLIES(!existing_value->IsSmi(),
+                       AccessorInfo::cast(existing_value)->name() ==
+                           *isolate->factory()->length_string());
+        if (!existing_value->IsSmi() ||
+            Smi::ToInt(existing_value) < key_index) {
           PropertyDetails details(kData, DONT_ENUM, PropertyCellType::kNoCell,
                                   enum_order);
           dictionary->DetailsAtPut(isolate, entry, details);
@@ -269,6 +275,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
                                         ? ACCESSOR_GETTER
                                         : ACCESSOR_SETTER;
       if (existing_value->IsAccessorPair()) {
+        // Update respective component of existing AccessorPair.
         AccessorPair current_pair = AccessorPair::cast(existing_value);
 
         int existing_component_index =
@@ -278,6 +285,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
         }
 
       } else {
+        // Overwrite existing value with new AccessorPair.
         Handle<AccessorPair> pair(isolate->factory()->NewAccessorPair());
         pair->set(component, value);
         PropertyDetails details(kAccessor, DONT_ENUM, PropertyCellType::kNoCell,

test/mjsunit/es6/computed-property-names-classes.js

@@ -213,6 +213,56 @@ function assertIteratorResult(value, done, result) {
 })();
 
 
+(function TestLength() {
+  class C {
+    static ['length']() {
+      return 42;
+    }
+  }
+  assertEquals(42, C.length());
+
+  class C1 {
+    static get ['length']() {
+      return 'A';
+    }
+  }
+  assertEquals('A', C1.length);
+
+  class C2 {
+    static get length() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      return 'B';
+    }
+  }
+  assertEquals('B', C2.length);
+
+  class C3 {
+    static get length() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      return 'C';
+    }
+  }
+  assertEquals('C', C3.length);
+
+  class C4 {
+    static get ['length']() {
+      assertUnreachable();
+    }
+    static get length() {
+      return 'D';
+    }
+  }
+  assertEquals('D', C4.length);
+})();
+
+
 (function TestGetter() {
   class C {
     get ['a']() {