Fix evaluation order of Object.prototype.hasOwnProperty

src/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $functionSourceString;
 var $globalEval;
 var $objectDefineOwnProperty;
 var $objectGetOwnPropertyDescriptor;
 var $toCompletePropertyDescriptor;
 
@@ skipping 156 matching lines @@
 }
 
 
 // ECMA-262 - 15.2.4.4
 function ObjectValueOf() {
   return TO_OBJECT_INLINE(this);
 }
 
 
 // ECMA-262 - 15.2.4.5
-function ObjectHasOwnProperty(V) {
-  if (%_IsJSProxy(this)) {
+function ObjectHasOwnProperty(value) {
+  var name = $toName(value);
+  var object = TO_OBJECT_INLINE(this);
+
+  if (%_IsJSProxy(object)) {
     // TODO(rossberg): adjust once there is a story for symbols vs proxies.
-    if (IS_SYMBOL(V)) return false;
+    if (IS_SYMBOL(value)) return false;
 
-    var handler = %GetHandler(this);
-    return CallTrap1(handler, "hasOwn", ProxyDerivedHasOwnTrap, $toName(V));
+    var handler = %GetHandler(object);
+    return CallTrap1(handler, "hasOwn", ProxyDerivedHasOwnTrap, name);
   }
-  return %HasOwnProperty(TO_OBJECT_INLINE(this), $toName(V));
+  return %HasOwnProperty(object, name);
 }
 
 
 // ECMA-262 - 15.2.4.6
 function ObjectIsPrototypeOf(V) {
   if (!IS_SPEC_OBJECT(V)) return false;
   CHECK_OBJECT_COERCIBLE(this, "Object.prototype.isPrototypeOf");
   return %IsInPrototypeChain(this, V);
 }
 
@@ skipping 1674 matching lines @@
   to.ObjectGetOwnPropertyKeys = ObjectGetOwnPropertyKeys;
   to.ObjectHasOwnProperty = ObjectHasOwnProperty;
   to.ObjectIsFrozen = ObjectIsFrozen;
   to.ObjectIsSealed = ObjectIsSealed;
   to.ObjectToString = ObjectToString;
   to.OwnPropertyKeys = OwnPropertyKeys;
   to.ToNameArray = ToNameArray;
 });
 
 })