Update next_enumeration_index_ correctly in ObjectDescriptor

next_enumeration_index is the next free index available to store a
property. ObjectDescriptor tracks this field while instantiating the
literal and updates the next_enumeration_index when finalizing the
instantiation. When adding new properties (named / computed) we were
updating this value to the current value that is being used instead
of next free index. This cl fixes it.

Bug: chromium:1152231
Change-Id: Ica8c36dcabf035db559e29d4573ecd5e53d6062a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2577463
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71709}

src/objects/literal-objects.cc

@@ -502,9 +502,9 @@ class ObjectDescriptor {
   }
 
   void UpdateNextEnumerationIndex(int value_index) {
-    int next_index = ComputeEnumerationIndex(value_index);
-    DCHECK_LT(next_enumeration_index_, next_index);
-    next_enumeration_index_ = next_index;
+    int current_index = ComputeEnumerationIndex(value_index);
+    DCHECK_LE(next_enumeration_index_, current_index);
+    next_enumeration_index_ = current_index + 1;
   }
 
   void Finalize(LocalIsolate* isolate) {

test/mjsunit/regress/regress-1152231.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function ID(x) {
+  return x;
+}
+
+function f2(v) {
+  var p = v.prototype;
+  Object.defineProperty(p, undefined, { });
+  assertArrayEquals(['constructor', 'a', 'b', 'c', 'd', 'undefined'],
+                    Object.getOwnPropertyNames(p));
+}
+
+function f22() {
+  class class1 {
+    a() {
+    }
+    get [ID('b')]() {
+    }
+    c() {
+    }
+    d() {
+    }
+  }
+  f2(class1);
+};
+
+f22();