[modules] Fix Object.prototype.hasOwnProperty on namespace objects.

This must throw for uninitialized properties.

R=adamk@chromium.org

Bug: v8:1569, v8:5487
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I8beb8bf6a197870eb5c038102ab474dd12f6b6eb
Reviewed-on: https://chromium-review.googlesource.com/582013
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46870}

include/v8.h

@@ -8996,8 +8996,8 @@ class Internals {
   static const int kNodeIsIndependentShift = 3;
   static const int kNodeIsActiveShift = 4;
 
-  static const int kJSApiObjectType = 0xbb;
-  static const int kJSObjectType = 0xbc;
+  static const int kJSApiObjectType = 0xbc;
+  static const int kJSObjectType = 0xbd;
   static const int kFirstNonstringType = 0x80;
   static const int kOddballType = 0x82;
   static const int kForeignType = 0x86;

src/objects-inl.h

@@ -5612,23 +5612,11 @@ Maybe<bool> JSReceiver::HasProperty(Handle<JSReceiver> object,
 }
 
 
-Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
-                                       Handle<Name> name) {
-  if (object->IsJSObject()) {  // Shortcut
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        object->GetIsolate(), object, name, object, LookupIterator::OWN);
-    return HasProperty(&it);
-  }
-
-  Maybe<PropertyAttributes> attributes =
-      JSReceiver::GetOwnPropertyAttributes(object, name);
-  MAYBE_RETURN(attributes, Nothing<bool>());
-  return Just(attributes.FromJust() != ABSENT);
-}
-
 Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
                                        uint32_t index) {
-  if (object->IsJSObject()) {  // Shortcut
+  if (object->IsJSModuleNamespace()) return Just(false);
+
+  if (object->IsJSObject()) {  // Shortcut.
     LookupIterator it(object->GetIsolate(), object, index, object,
                       LookupIterator::OWN);
     return HasProperty(&it);

src/objects.cc

@@ -1002,6 +1002,26 @@ Maybe<bool> JSReceiver::HasProperty(LookupIterator* it) {
   return Just(false);
 }
 
+// static
+Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
+                                       Handle<Name> name) {
+  if (object->IsJSModuleNamespace()) {
+    PropertyDescriptor desc;
+    return JSReceiver::GetOwnPropertyDescriptor(object->GetIsolate(), object,
+                                                name, &desc);
+  }
+
+  if (object->IsJSObject()) {  // Shortcut.
+    LookupIterator it = LookupIterator::PropertyOrElement(
+        object->GetIsolate(), object, name, object, LookupIterator::OWN);
+    return HasProperty(&it);
+  }
+
+  Maybe<PropertyAttributes> attributes =
+      JSReceiver::GetOwnPropertyAttributes(object, name);
+  MAYBE_RETURN(attributes, Nothing<bool>());
+  return Just(attributes.FromJust() != ABSENT);
+}
 
 // static
 MaybeHandle<Object> Object::GetProperty(LookupIterator* it) {

src/objects.h

@@ -379,6 +379,7 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(JS_PROXY_TYPE)                                              \
   V(JS_GLOBAL_OBJECT_TYPE)                                      \
   V(JS_GLOBAL_PROXY_TYPE)                                       \
+  V(JS_MODULE_NAMESPACE_TYPE)                                   \
   V(JS_SPECIAL_API_OBJECT_TYPE)                                 \
   V(JS_VALUE_TYPE)                                              \
   V(JS_MESSAGE_OBJECT_TYPE)                                     \
@@ -389,7 +390,6 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(JS_CONTEXT_EXTENSION_OBJECT_TYPE)                           \
   V(JS_GENERATOR_OBJECT_TYPE)                                   \
   V(JS_ASYNC_GENERATOR_OBJECT_TYPE)                             \
-  V(JS_MODULE_NAMESPACE_TYPE)                                   \
   V(JS_ARRAY_TYPE)                                              \
   V(JS_ARRAY_BUFFER_TYPE)                                       \
   V(JS_TYPED_ARRAY_TYPE)                                        \
@@ -730,6 +730,7 @@ enum InstanceType : uint8_t {
   JS_PROXY_TYPE,          // FIRST_JS_RECEIVER_TYPE
   JS_GLOBAL_OBJECT_TYPE,  // FIRST_JS_OBJECT_TYPE
   JS_GLOBAL_PROXY_TYPE,
+  JS_MODULE_NAMESPACE_TYPE,
   // Like JS_API_OBJECT_TYPE, but requires access checks and/or has
   // interceptors.
   JS_SPECIAL_API_OBJECT_TYPE,  // LAST_SPECIAL_RECEIVER_TYPE
@@ -743,7 +744,6 @@ enum InstanceType : uint8_t {
   JS_CONTEXT_EXTENSION_OBJECT_TYPE,
   JS_GENERATOR_OBJECT_TYPE,
   JS_ASYNC_GENERATOR_OBJECT_TYPE,
-  JS_MODULE_NAMESPACE_TYPE,
   JS_ARRAY_TYPE,
   JS_ARRAY_BUFFER_TYPE,
   JS_TYPED_ARRAY_TYPE,
@@ -2013,8 +2013,8 @@ class JSReceiver: public HeapObject {
   MUST_USE_RESULT static inline Maybe<bool> HasElement(
       Handle<JSReceiver> object, uint32_t index);
 
-  MUST_USE_RESULT static inline Maybe<bool> HasOwnProperty(
-      Handle<JSReceiver> object, Handle<Name> name);
+  MUST_USE_RESULT static Maybe<bool> HasOwnProperty(Handle<JSReceiver> object,
+                                                    Handle<Name> name);
   MUST_USE_RESULT static inline Maybe<bool> HasOwnProperty(
       Handle<JSReceiver> object, uint32_t index);
 

src/runtime/runtime-object.cc

@@ -236,7 +236,19 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
 
   Handle<Object> object = args.at(0);
 
-  if (object->IsJSObject()) {
+  if (object->IsJSModuleNamespace()) {
+    if (key.is_null()) {
+      DCHECK(key_is_array_index);
+      // Namespace objects can't have indexed properties.
+      return isolate->heap()->false_value();
+    }
+
+    Maybe<bool> result =
+        JSReceiver::HasOwnProperty(Handle<JSReceiver>::cast(object), key);
+    if (!result.IsJust()) return isolate->heap()->exception();
+    return isolate->heap()->ToBoolean(result.FromJust());
+
+  } else if (object->IsJSObject()) {
     Handle<JSObject> js_obj = Handle<JSObject>::cast(object);
     // Fast case: either the key is a real named property or it is not
     // an array index and there are no interceptors or hidden

test/test262/test262.status

@@ -367,8 +367,6 @@
   'language/statements/async-function/early-errors-declaration-formals-body-duplicate': [FAIL],
 
   # Module-related tests
-  # v8:5487
-  'language/module-code/namespace/internals/get-own-property-str-found-uninit': [FAIL],
   # https://github.com/tc39/ecma262/pull/858
   'language/module-code/namespace/internals/set': [FAIL],
   'language/module-code/namespace/internals/define-own-property': [FAIL],

tools/v8heapconst.py

@@ -84,17 +84,17 @@ INSTANCE_TYPES = {
   180: "JS_PROXY_TYPE",
   181: "JS_GLOBAL_OBJECT_TYPE",
   182: "JS_GLOBAL_PROXY_TYPE",
-  183: "JS_SPECIAL_API_OBJECT_TYPE",
-  184: "JS_VALUE_TYPE",
-  185: "JS_MESSAGE_OBJECT_TYPE",
-  186: "JS_DATE_TYPE",
-  187: "JS_API_OBJECT_TYPE",
-  188: "JS_OBJECT_TYPE",
-  189: "JS_ARGUMENTS_TYPE",
-  190: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
-  191: "JS_GENERATOR_OBJECT_TYPE",
-  192: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
-  193: "JS_MODULE_NAMESPACE_TYPE",
+  183: "JS_MODULE_NAMESPACE_TYPE",
+  184: "JS_SPECIAL_API_OBJECT_TYPE",
+  185: "JS_VALUE_TYPE",
+  186: "JS_MESSAGE_OBJECT_TYPE",
+  187: "JS_DATE_TYPE",
+  188: "JS_API_OBJECT_TYPE",
+  189: "JS_OBJECT_TYPE",
+  190: "JS_ARGUMENTS_TYPE",
+  191: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
+  192: "JS_GENERATOR_OBJECT_TYPE",
+  193: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
   194: "JS_ARRAY_TYPE",
   195: "JS_ARRAY_BUFFER_TYPE",
   196: "JS_TYPED_ARRAY_TYPE",
@@ -203,7 +203,7 @@ KNOWN_MAPS = {
   0x03019: (170, "SloppyArgumentsElementsMap"),
   0x03071: (178, "SmallOrderedHashMapMap"),
   0x030c9: (179, "SmallOrderedHashSetMap"),
-  0x03121: (185, "JSMessageObjectMap"),
+  0x03121: (186, "JSMessageObjectMap"),
   0x03179: (136, "BytecodeArrayMap"),
   0x031d1: (170, "ModuleInfoMap"),
   0x03229: (175, "NoClosuresCellMap"),
@@ -244,7 +244,7 @@ KNOWN_MAPS = {
   0x03e31: (170, "DebugEvaluateContextMap"),
   0x03e89: (170, "ScriptContextTableMap"),
   0x03ee1: (171, "UnseededNumberDictionaryMap"),
-  0x03f39: (188, "ExternalMap"),
+  0x03f39: (189, "ExternalMap"),
   0x03f91: (106, "NativeSourceStringMap"),
   0x03fe9: (152, "InterceptorInfoMap"),
   0x04041: (207, "JSPromiseCapabilityMap"),