[runtime] Handle when JSProxy::HasProperty returns Nothing

JSProxy::HasProperty returns Nothing<bool>() when there is an
exception when executing has trap handler. We should not treat
these cases similar to not found cases.

Bug: chromium:1018871
Change-Id: I5510e707c96576d2dca4c8402e21a89065cc9b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886919Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64670}

src/objects/objects.cc

@@ -1102,7 +1102,8 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
         if (is_global_reference) {
           Maybe<bool> maybe = JSProxy::HasProperty(
               it->isolate(), it->GetHolder<JSProxy>(), it->GetName());
-          if (maybe.IsNothing() || !maybe.FromJust()) {
+          if (maybe.IsNothing()) return MaybeHandle<Object>();
+          if (!maybe.FromJust()) {
             it->NotFound();
             return it->isolate()->factory()->undefined_value();
           }

test/mjsunit/regress/regress-1018871.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v_this = this;
+function f() {
+  var obj = {y: 0};
+  var proxy = new Proxy(obj, {
+    has() { y; },
+  });
+  Object.setPrototypeOf(v_this, proxy);
+  x;
+}
+assertThrows(f, RangeError);