[runtime] Don't normalize JSGlobalProxy

Object.assign should not normalize JSGlobalProxy objects.

Bug: chromium:1139769
Change-Id: Ie7e24f6498267966b7553b0c5994307f5b632b0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485505Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70713}

src/objects/js-objects.cc

@@ -319,7 +319,10 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
                               GetKeysConversion::kKeepNumbers),
       Nothing<bool>());
 
-  if (!from->HasFastProperties() && target->HasFastProperties()) {
+  if (!from->HasFastProperties() && target->HasFastProperties() &&
+      !target->IsJSGlobalProxy()) {
+    // JSProxy is always in slow-mode.
+    DCHECK(!target->IsJSProxy());
     // Convert to slow properties if we're guaranteed to overflow the number of
     // descriptors.
     int source_length =

test/mjsunit/es6/object-assign.js

@@ -4,6 +4,8 @@
 
 // Based on Mozilla Object.assign() tests
 
+// Flags: --allow-natives-syntax
+
 function checkDataProperty(object, propertyKey, value, writable, enumerable, configurable) {
   var desc = Object.getOwnPropertyDescriptor(object, propertyKey);
   assertFalse(desc === undefined);
@@ -227,19 +229,59 @@ assertSame(Object.assign(o, {}), o);
   assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
 })();
 
+(function proxy() {
+  const fast_source = { key1: "value1", key2: "value2"};
+  const slow_source = {__proto__:null};
+  for (let i = 0; i < 2000; i++) {
+    slow_source["key" + i] = i;
+  }
+
+  const empty_handler = {};
+  let target = {};
+  let proxy = new Proxy(target, empty_handler);
+  assertArrayEquals(Object.keys(target), []);
+  let result = Object.assign(proxy, fast_source);
+  %HeapObjectVerify(result);
+  assertArrayEquals(Object.keys(result), Object.keys(target));
+  assertArrayEquals(Object.keys(result), Object.keys(fast_source));
+  assertArrayEquals(Object.values(result), Object.values(fast_source));
+
+  target = {};
+  proxy = new Proxy(target, empty_handler);
+  assertArrayEquals(Object.keys(target), []);
+  result = Object.assign(proxy, slow_source);
+  %HeapObjectVerify(result);
+  assertEquals(Object.keys(result).length, Object.keys(target).length);
+  assertEquals(Object.keys(result).length, Object.keys(slow_source).length);
+})();
+
 (function global_object() {
   let source = {
     global1: "global1",
     get global2() { return "global2" },
   };
   let result = Object.assign(globalThis, source);
+  %HeapObjectVerify(result);
   assertTrue(result === globalThis);
   assertTrue(result.global1 === source.global1);
   assertTrue(result.global2 === source.global2);
 
   let target = {};
   result = Object.assign(target, globalThis);
+  %HeapObjectVerify(result);
   assertTrue(result === target);
   assertTrue(result.global1 === source.global1);
   assertTrue(result.global2 === source.global2);
+
+  for (let i = 0; i < 2000; i++) {
+    source["property" + i] = i;
+  }
+  result = Object.assign(globalThis, source);
+  %HeapObjectVerify(result);
+  assertTrue(result === globalThis);
+  for (let i = 0; i < 2000; i++) {
+    const key = "property" + i;
+    assertEquals(result[key], i);
+  }
+
 })();