Fix v8::Value::IsExternal() map check.

Insertion into a collection changes the map because of the addition of
the hash value property.  Check the root map, not the current map.

Fixes: https://github.com/nodejs/node/issues/14139
Change-Id: Iabcea5337323b9b6deffa1a06892c1cb749f2065
Reviewed-on: https://chromium-review.googlesource.com/566833Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46614}

src/objects-inl.h

@@ -150,9 +150,8 @@ bool HeapObject::IsJSGeneratorObject() const {
 
 bool HeapObject::IsBoilerplateDescription() const { return IsFixedArray(); }
 
-// External objects are not extensible, so the map check is enough.
 bool HeapObject::IsExternal() const {
-  return map() == GetHeap()->external_map();
+  return map()->FindRootMap() == GetHeap()->external_map();
 }
 
 #define IS_TYPE_FUNCTION_DEF(type_)                               \

test/cctest/test-api.cc

@@ -3993,6 +3993,15 @@ THREADED_TEST(External) {
   *ptr = 10;
   CHECK_EQ(x, 10);
 
+  {
+    i::Handle<i::Object> obj = v8::Utils::OpenHandle(*ext);
+    CHECK_EQ(i::HeapObject::cast(*obj)->map(), CcTest::heap()->external_map());
+    CHECK(ext->IsExternal());
+    CHECK(!CompileRun("new Set().add(this.ext)").IsEmpty());
+    CHECK_NE(i::HeapObject::cast(*obj)->map(), CcTest::heap()->external_map());
+    CHECK(ext->IsExternal());
+  }
+
   // Make sure unaligned pointers are wrapped properly.
   char* data = i::StrDup("0123456789");
   Local<v8::Value> zero = v8::External::New(CcTest::isolate(), &data[0]);