[runtime] Fix global_dictionary case in SetOrCopyDataProperties

Bug: chromium:1133210
Change-Id: Ic60e88ab3c50602a71387f7c3a1253d70a7c69fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2450061Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70341}

src/objects/js-objects.cc

@@ -323,7 +323,11 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
     // Convert to slow properties if we're guaranteed to overflow the number of
     // descriptors.
     int source_length =
-        from->property_dictionary().NumberOfEnumerableProperties();
+        from->IsJSGlobalObject()
+            ? JSGlobalObject::cast(*from)
+                  .global_dictionary()
+                  .NumberOfEnumerableProperties()
+            : from->property_dictionary().NumberOfEnumerableProperties();
     if (source_length > kMaxNumberOfDescriptors) {
       JSObject::NormalizeProperties(isolate, Handle<JSObject>::cast(target),
                                     CLEAR_INOBJECT_PROPERTIES, source_length,

test/mjsunit/es6/object-assign.js

@@ -226,3 +226,20 @@ assertSame(Object.assign(o, {}), o);
 
   assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
 })();
+
+(function global_object() {
+  let source = {
+    global1: "global1",
+    get global2() { return "global2" },
+  };
+  let result = Object.assign(globalThis, source);
+  assertTrue(result === globalThis);
+  assertTrue(result.global1 === source.global1);
+  assertTrue(result.global2 === source.global2);
+
+  let target = {};
+  result = Object.assign(target, globalThis);
+  assertTrue(result === target);
+  assertTrue(result.global1 === source.global1);
+  assertTrue(result.global2 === source.global2);
+})();

test/mjsunit/es8/object-values.js

@@ -276,3 +276,9 @@ TestMutateDuringEnumeration();
     assertEquals(result1, result2, `slow Object.values() with ${kind}`);
   }
 })();
+
+
+(function TestGlobalObject() {
+  let values = Object.values(globalThis);
+  assertTrue(values.length > 0);
+})();