[es6] silence access-check failure for well-known symbol properties

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins.h"
 
 #include "src/api.h"
 #include "src/api-natives.h"
 #include "src/arguments.h"
 #include "src/base/once.h"
@@ skipping 1168 matching lines @@
       JSReceiver::HasProperty(Handle<JSReceiver>::cast(obj), key);
   if (!maybe.IsJust()) return false;
   return maybe.FromJust();
 }
 
 
 bool IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
   HandleScope handle_scope(isolate);
   if (!obj->IsSpecObject()) return false;
   if (FLAG_harmony_concat_spreadable) {
+    // [[Get]] @@isConcatSpreadable from object. If an access check failed,
+    // ignore the resulting value and use the default behaviour. Otherwise,
+    // use the boolean value of the result.
     Handle<Symbol> key(isolate->factory()->is_concat_spreadable_symbol());
     Handle<Object> value;
+    bool access_check_failed;
+    LookupIterator it(obj, key, LookupIterator::DEFAULT);
     MaybeHandle<Object> maybeValue =
-        i::Runtime::GetObjectProperty(isolate, obj, key);
-    if (maybeValue.ToHandle(&value) && !value->IsUndefined()) {
+        Object::GetPropertyEx(&it, access_check_failed);
+    if (!access_check_failed && maybeValue.ToHandle(&value) &&
+        !value->IsUndefined()) {
       return value->BooleanValue();
     }
   }
   return obj->IsJSArray();
 }
 
 
 /**
  * Array::concat implementation.
  * See ECMAScript 262, 15.4.4.4.
@@ skipping 885 matching lines @@
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 }  // namespace internal
 }  // namespace v8