[objects] Propagate an exception from property descriptor interceptor

Property descriptor interceptor may and may not throw an
exception.  If it's thrown, V8 has to propagate the exception
appropriately.

Especially HTML ([1][2]) requires that the cross origin case of
getOwnPropertyDescriptor throws a SecurityError.  Hence, Blink
is going to throw a SecurityError in the cross origin descriptor
interceptor.  Then, this fix is necessary.

[1] https://html.spec.whatwg.org/C#windowproxy-getownproperty
[2] https://html.spec.whatwg.org/C#location-getownproperty

Change-Id: I7e3a92f1a16f1a2cda3818fd585a89fd83989003
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297076Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68898}

src/objects/js-objects.cc

@@ -1552,6 +1552,8 @@ Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
   } else {
     result = args.CallNamedDescriptor(interceptor, it->name());
   }
+  // An exception was thrown in the interceptor. Propagate.
+  RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, Nothing<bool>());
   if (!result.is_null()) {
     // Request successfully intercepted, try to set the property
     // descriptor.