[proxies] do not leak private symbols to proxy traps

BUG=v8:4537
LOG=N
R=neis@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1492923002

Cr-Commit-Position: refs/heads/master@{#32570}

src/lookup.cc

@@ -609,7 +609,10 @@ LookupIterator::State LookupIterator::LookupInHolder(Map* const map,
   }
   switch (state_) {
     case NOT_FOUND:
-      if (map->IsJSProxyMap()) return JSPROXY;
+      if (map->IsJSProxyMap()) {
+        if (!name_.is_null() && name_->IsPrivate()) return NOT_FOUND;
+        return JSPROXY;
+      }
       if (map->is_access_check_needed() &&
           (IsElement() || !isolate_->IsInternallyUsedPropertyName(name_))) {
         return ACCESS_CHECK;

test/mjsunit/harmony/proxies-get.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-proxies
+// Flags: --harmony-proxies --harmony-reflect --allow-natives-syntax
 
 (function testBasicFunctionality() {
    var target = {
@@ -93,3 +93,27 @@
   assertEquals("value", proxy.key2);
   assertThrows(function(){ proxy.key3 }, TypeError);
 })();
+
+(function testGetInternalIterators() {
+  var log = [];
+  var array = [1,2,3,4,5]
+  var origIt = array[Symbol.iterator]();
+  var it = new Proxy(origIt, {
+    get(t, name) {
+      log.push(`[[Get]](iterator, ${String(name)})`);
+      return Reflect.get(t, name);
+    },
+    set(t, name, val) {
+      log.push(`[[Set]](iterator, ${String(name)}, ${String(val)})`);
+      return Reflect.set(t, name, val);
+    }
+  });
+
+  assertThrows(function() {
+    for (var v of it) log.push(v);
+  }, TypeError);
+  assertEquals([
+    "[[Get]](iterator, Symbol(Symbol.iterator))",
+    "[[Get]](iterator, next)"
+  ], log);
+})();