[wasm] Fix property accessors to not be constructors.

This fixes the accessor functions (getters and setters) for WebAssembly
accessor properties to not have 'prototype' properties and not be marked
as constructors.

R=ahaas@chromium.org
TEST=mjsunit/wasm/js-api
BUG=chromium:1027945

Change-Id: I0288f511fee1f99997031b41354ecf7b8629b783
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943157
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65265}

src/wasm/wasm-js.cc

@@ -1880,10 +1880,10 @@ void WebAssemblyGlobalType(const v8::FunctionCallbackInfo<v8::Value>& args) {
 // TODO(titzer): we use the API to create the function template because the
 // internal guts are too ugly to replicate here.
 static i::Handle<i::FunctionTemplateInfo> NewFunctionTemplate(
-    i::Isolate* i_isolate, FunctionCallback func) {
+    i::Isolate* i_isolate, FunctionCallback func, bool has_prototype) {
   Isolate* isolate = reinterpret_cast<Isolate*>(i_isolate);
   Local<FunctionTemplate> templ = FunctionTemplate::New(isolate, func);
-  templ->ReadOnlyPrototype();
+  has_prototype ? templ->ReadOnlyPrototype() : templ->RemovePrototype();
   return v8::Utils::OpenHandle(*templ);
 }
 
@@ -1897,20 +1897,23 @@ static i::Handle<i::ObjectTemplateInfo> NewObjectTemplate(
 namespace internal {
 
 Handle<JSFunction> CreateFunc(Isolate* isolate, Handle<String> name,
-                              FunctionCallback func) {
-  Handle<FunctionTemplateInfo> temp = NewFunctionTemplate(isolate, func);
+                              FunctionCallback func, bool has_prototype) {
+  Handle<FunctionTemplateInfo> temp =
+      NewFunctionTemplate(isolate, func, has_prototype);
   Handle<JSFunction> function =
       ApiNatives::InstantiateFunction(temp, name).ToHandleChecked();
   DCHECK(function->shared().HasSharedName());
   return function;
 }
 
+// TODO(mstarzinger): Pass {has_prototype} as an argument and audit all calls
+// for whether a "prototype" property is expected. Also add respective tests.
 Handle<JSFunction> InstallFunc(Isolate* isolate, Handle<JSObject> object,
                                const char* str, FunctionCallback func,
                                int length = 0,
                                PropertyAttributes attributes = NONE) {
   Handle<String> name = v8_str(isolate, str);
-  Handle<JSFunction> function = CreateFunc(isolate, name, func);
+  Handle<JSFunction> function = CreateFunc(isolate, name, func, true);
   function->shared().set_length(length);
   JSObject::AddProperty(isolate, object, name, function, attributes);
   return function;
@@ -1932,7 +1935,7 @@ void InstallGetter(Isolate* isolate, Handle<JSObject> object, const char* str,
                    FunctionCallback func) {
   Handle<String> name = v8_str(isolate, str);
   Handle<JSFunction> function =
-      CreateFunc(isolate, GetterName(isolate, name), func);
+      CreateFunc(isolate, GetterName(isolate, name), func, false);
 
   Utils::ToLocal(object)->SetAccessorProperty(Utils::ToLocal(name),
                                               Utils::ToLocal(function),
@@ -1949,9 +1952,9 @@ void InstallGetterSetter(Isolate* isolate, Handle<JSObject> object,
                          FunctionCallback setter) {
   Handle<String> name = v8_str(isolate, str);
   Handle<JSFunction> getter_func =
-      CreateFunc(isolate, GetterName(isolate, name), getter);
+      CreateFunc(isolate, GetterName(isolate, name), getter, false);
   Handle<JSFunction> setter_func =
-      CreateFunc(isolate, SetterName(isolate, name), setter);
+      CreateFunc(isolate, SetterName(isolate, name), setter, false);
   setter_func->shared().set_length(1);
 
   v8::PropertyAttribute attributes = v8::None;

test/mjsunit/wasm/js-api.js

@@ -380,6 +380,9 @@ assertEq(Object.getPrototypeOf(exportingInstance), instanceProto);
 let instanceExportsDesc =
     Object.getOwnPropertyDescriptor(instanceProto, 'exports');
 assertEq(typeof instanceExportsDesc.get, 'function');
+assertEq(instanceExportsDesc.get.name, 'get exports');
+assertEq(instanceExportsDesc.get.length, 0);
+assertFalse('prototype' in instanceExportsDesc.get);
 assertEq(instanceExportsDesc.set, undefined);
 assertTrue(instanceExportsDesc.enumerable);
 assertTrue(instanceExportsDesc.configurable);
@@ -456,6 +459,9 @@ assertEq(Object.getPrototypeOf(mem1), memoryProto);
 // 'WebAssembly.Memory.prototype.buffer' accessor property
 let bufferDesc = Object.getOwnPropertyDescriptor(memoryProto, 'buffer');
 assertEq(typeof bufferDesc.get, 'function');
+assertEq(bufferDesc.get.name, 'get buffer');
+assertEq(bufferDesc.get.length, 0);
+assertFalse('prototype' in bufferDesc.get);
 assertEq(bufferDesc.set, undefined);
 assertTrue(bufferDesc.enumerable);
 assertTrue(bufferDesc.configurable);
@@ -476,7 +482,6 @@ assertTrue(memGrowDesc.enumerable);
 assertTrue(memGrowDesc.configurable);
 
 // 'WebAssembly.Memory.prototype.grow' method
-
 let memGrow = memGrowDesc.value;
 assertEq(memGrow.length, 1);
 assertThrows(
@@ -608,6 +613,9 @@ assertEq(Object.getPrototypeOf(tbl1), tableProto);
 // 'WebAssembly.Table.prototype.length' accessor data property
 let lengthDesc = Object.getOwnPropertyDescriptor(tableProto, 'length');
 assertEq(typeof lengthDesc.get, 'function');
+assertEq(lengthDesc.get.name, 'get length');
+assertEq(lengthDesc.get.length, 0);
+assertFalse('prototype' in lengthDesc.get);
 assertEq(lengthDesc.set, undefined);
 assertTrue(lengthDesc.enumerable);
 assertTrue(lengthDesc.configurable);
@@ -913,3 +921,25 @@ assertInstantiateSuccess(
   assertThrows(() => new WebAssembly.Global({ value: "i64" }, 1n), TypeError,
                /Can't set the value/);
 })();
+
+(function TestAccessorFunctions() {
+  function isConstructor(value) {
+    var p = new Proxy(value, { construct: () => ({}) });
+    try {
+      return new p, true;
+    } catch(e) {
+      return false;
+    }
+  };
+  function testAccessorFunction(obj, prop, accessor) {
+    var desc = Object.getOwnPropertyDescriptor(obj, prop);
+    assertSame('function', typeof desc[accessor]);
+    assertFalse(desc[accessor].hasOwnProperty('prototype'));
+    assertFalse(isConstructor(desc[accessor]));
+  }
+  testAccessorFunction(WebAssembly.Global.prototype, "value", "get");
+  testAccessorFunction(WebAssembly.Global.prototype, "value", "set");
+  testAccessorFunction(WebAssembly.Instance.prototype, "exports", "get");
+  testAccessorFunction(WebAssembly.Memory.prototype, "buffer", "get");
+  testAccessorFunction(WebAssembly.Table.prototype, "length", "get");
+})();