[proxy] Properly handle exceptions from Object::ToName().

... when storing to proxies.

Bug: chromium:772897
Change-Id: Ia91e69f35dc3b1f67b67038bd8206e508149e9a3
Reviewed-on: https://chromium-review.googlesource.com/744041Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49039}

src/runtime/runtime-proxy.cc

@@ -51,11 +51,11 @@ RUNTIME_FUNCTION(Runtime_GetPropertyWithReceiver) {
 
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, name, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 2);
 
-  bool success;
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, name,
+  bool success = false;
+  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
                                                         &success, holder);
   if (!success) {
     DCHECK(isolate->has_pending_exception());
@@ -69,15 +69,18 @@ RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
 
   DCHECK_EQ(5, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, name, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 3);
   CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode, 4);
 
-  bool success;
-  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, name,
+  bool success = false;
+  LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
                                                         &success, holder);
-
+  if (!success) {
+    DCHECK(isolate->has_pending_exception());
+    return isolate->heap()->exception();
+  }
   Maybe<bool> result = Object::SetSuperProperty(
       &it, value, language_mode, Object::MAY_BE_STORE_FROM_KEYED);
   MAYBE_RETURN(result, isolate->heap()->exception());

test/mjsunit/regress/regress-crbug-772897.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function store(obj, name) {
+  return obj[name] = 0;
+}
+
+function f(obj) {
+  var key = {
+    toString() { throw new Error("boom"); }
+  };
+  store(obj, key);
+}
+
+(function() {
+  var proxy = new Proxy({}, {});
+  store(proxy, 0)
+  assertThrows(() => f(proxy), Error);
+})();