[proxies] do not leak private symbols to proxy traps

test/mjsunit/harmony/proxies-define-property.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-proxies
+// Flags: --harmony-proxies --harmony-reflect --allow-natives-syntax
 
 // Check basic call to trap.
 
 var g_target, g_name, g_desc;
 var handler = {
   defineProperty: function(target, name, desc) {
     g_target = target;
     g_name = name;
     g_desc = desc;
     return true;
@@ skipping 50 matching lines @@
 // Step 16a: Trap returns true for non-compatible property descriptor.
 Object.defineProperty(target, "foo",
                       {value: 1, writable: false, configurable: false});
 assertThrows("Object.defineProperty(proxy, 'foo', {value: 2})", TypeError);
 
 // Step 16b: Trap returns true for overwriting a configurable property
 // with a non-configurable descriptor.
 target.bar = "baz";
 assertThrows("Object.defineProperty(proxy, 'bar', {configurable: false})",
              TypeError);
+
+(function testDefinePrivateSymbol() {
+  var symbol = %CreatePrivateSymbol("secret");
+  var O = {};
+  Object.defineProperty(O, symbol, { value: "value", configurable: true });
+  assertEquals("value", O[symbol]);
+  var proxy = new Proxy(O, { defineProperty(t, n, d) { assertUnreachable(); }});
+  Object.defineProperty(O, symbol, { value: "value", configurable: true });
+  assertEquals(undefined, proxy[symbol]);
+  assertEquals(undefined, Reflect.get(proxy, symbol));
+
+  assertEquals(
+      true, Reflect.defineProperty(O, symbol,
+                                   { value: "value2", configurable: true }));

[neis, 2015/12/03 12:01:24]

assertTrue

+
+  assertEquals(
+      false, Reflect.defineProperty(proxy, symbol,
+                                    { value: "value2", configurable: true }));
+})();

[neis, 2015/12/03 12:01:24]

assertFalse