Do not leak private property names to proxy traps and interceptors.

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/lookup.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/elements.h"
 #include "src/isolate-inl.h"
@@ skipping 592 matching lines @@
 LookupIterator::State LookupIterator::LookupInHolder(Map* const map,
                                                      JSReceiver* const holder) {
   STATIC_ASSERT(INTERCEPTOR == BEFORE_PROPERTY);
   DisallowHeapAllocation no_gc;
   if (interceptor_state_ == InterceptorState::kProcessNonMasking) {
     return LookupNonMaskingInterceptorInHolder(map, holder);
   }
   switch (state_) {
     case NOT_FOUND:
       if (map->IsJSProxyMap()) {
+        // Do not leak private property names.
         if (!name_.is_null() && name_->IsPrivate()) return NOT_FOUND;
         return JSPROXY;
       }
       if (map->is_access_check_needed() &&
           (IsElement() || !isolate_->IsInternallyUsedPropertyName(name_))) {
         return ACCESS_CHECK;
       }
     // Fall through.
     case ACCESS_CHECK:
       if (exotic_index_state_ != ExoticIndexState::kNotExotic &&
           holder->IsJSTypedArray() && IsIntegerIndexedExotic(holder)) {
         return INTEGER_INDEXED_EXOTIC;
       }
       if (check_interceptor() && HasInterceptor(map) &&
           !SkipInterceptor(JSObject::cast(holder))) {
+        // Do not leak private property names.
+        if (!name_.is_null() && name_->IsPrivate()) return NOT_FOUND;
         return INTERCEPTOR;
       }
     // Fall through.
     case INTERCEPTOR:
       if (IsElement()) {
         // TODO(verwaest): Optimize.
         if (holder->IsStringObjectWithCharacterAt(index_)) {
           PropertyAttributes attributes =
               static_cast<PropertyAttributes>(READ_ONLY | DONT_DELETE);
           property_details_ = PropertyDetails(attributes, v8::internal::DATA, 0,
@@ skipping 64 matching lines @@
     // Fall through.
     default:
       return NOT_FOUND;
   }
   UNREACHABLE();
   return state_;
 }
 
 }  // namespace internal
 }  // namespace v8