Fix Array.indexOf for Proxies that throw

When the slow path for Array.prototype.indexOf calls a Proxy's "has"
trap, it must check afterwards whether an exception was thrown.

BUG=chromium:728813

Change-Id: I998bba6ddcd65adfed2eefb63b3285da60d2a43c
Reviewed-on: https://chromium-review.googlesource.com/527173Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45759}

src/runtime/runtime-array.cc

@@ -610,9 +610,9 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
       LookupIterator it = LookupIterator::PropertyOrElement(
           isolate, object, index_obj, &success);
       DCHECK(success);
-      if (!JSReceiver::HasProperty(&it).FromJust()) {
-        continue;
-      }
+      Maybe<bool> present = JSReceiver::HasProperty(&it);
+      MAYBE_RETURN(present, isolate->heap()->exception());
+      if (!present.FromJust()) continue;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, element_k,
                                          Object::GetProperty(&it));
       if (search_element->StrictEquals(*element_k)) {

test/mjsunit/regress/regress-crbug-728813.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var p = new Proxy({}, {
+  has: function () { throw "nope"; }
+});
+p.length = 2;
+assertThrows(() => Array.prototype.indexOf.call(p));