Improve error handling of proxies get property

Bug: chromium:763683, v8:6560
Change-Id: I0769a8a2280a08fe0c768b6330d15cfbb1500f6b
Reviewed-on: https://chromium-review.googlesource.com/663218Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47978}

src/runtime/runtime-proxy.cc

@@ -57,6 +57,10 @@ RUNTIME_FUNCTION(Runtime_GetPropertyWithReceiver) {
   bool success;
   LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, name,
                                                         &success, holder);
+  if (!success) {
+    DCHECK(isolate->has_pending_exception());
+    return isolate->heap()->exception();
+  }
   RETURN_RESULT_OR_FAILURE(isolate, Object::GetProperty(&it));
 }
 

test/mjsunit/regress/regress-crbug-763683.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function test() {
+  var proxy = new Proxy({}, {});
+  var key_or_proxy = 0;
+
+  function failing_get() {
+    return proxy[key_or_proxy];
+  }
+
+  failing_get();
+
+  key_or_proxy = new Proxy({
+    toString() {
+      throw new TypeError('error');
+    }
+  }, {});
+
+  failing_get();
+}, TypeError);