Fix evaluation order of Object.prototype.hasOwnProperty

We need to do the ToName before the ToObject.

BUG=v8:4229
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1211663002

Cr-Commit-Position: refs/heads/master@{#29272}

src/v8natives.js

@@ -174,15 +174,18 @@ function ObjectValueOf() {
 
 
 // ECMA-262 - 15.2.4.5
-function ObjectHasOwnProperty(V) {
-  if (%_IsJSProxy(this)) {
+function ObjectHasOwnProperty(value) {
+  var name = $toName(value);
+  var object = TO_OBJECT_INLINE(this);
+
+  if (%_IsJSProxy(object)) {
     // TODO(rossberg): adjust once there is a story for symbols vs proxies.
-    if (IS_SYMBOL(V)) return false;
+    if (IS_SYMBOL(value)) return false;
 
-    var handler = %GetHandler(this);
-    return CallTrap1(handler, "hasOwn", ProxyDerivedHasOwnTrap, $toName(V));
+    var handler = %GetHandler(object);
+    return CallTrap1(handler, "hasOwn", ProxyDerivedHasOwnTrap, name);
   }
-  return %HasOwnProperty(TO_OBJECT_INLINE(this), $toName(V));
+  return %HasOwnProperty(object, name);
 }
 
 

test/mjsunit/has-own-property-evaluation-order.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function MyError() {}
+
+assertThrows(function() {
+  Object.prototype.hasOwnProperty.call(null, {
+    toString() {
+      throw new MyError();
+    }
+  });
+}, MyError);