LookupIterator should find private symbols on JSProxies

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index 1ffd888350bda9c46c8b5b6de434edb4d8d74db0..a2d51b490d9c2f4ac45e9c6a7617f36f9a38829d 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -611,8 +611,7 @@ LookupIterator::State LookupIterator::LookupInHolder(Map* const map,
     case NOT_FOUND:
       if (map->IsJSProxyMap()) {
         // Do not leak private property names.
-        if (!name_.is_null() && name_->IsPrivate()) return NOT_FOUND;
-        return JSPROXY;
+        if (name_.is_null() || !name_->IsPrivate()) return JSPROXY;

[neis, 2016/01/13 13:53:48]

This looks wrong.  I think you should just return JSProxy unconditionally.  But
before you do that, you should modify the proxy operations (JSProxy::GetProperty
etc) to always consult the proxy's property store for private symbols.

       }
       if (map->is_access_check_needed() &&
           (IsElement() || !isolate_->IsInternallyUsedPropertyName(name_))) {
@@ -668,7 +667,7 @@ LookupIterator::State LookupIterator::LookupInHolder(Map* const map,
         if (cell->value()->IsTheHole()) return NOT_FOUND;
         property_details_ = cell->property_details();
       } else {
-        NameDictionary* dict = JSObject::cast(holder)->property_dictionary();
+        NameDictionary* dict = holder->property_dictionary();
         int number = dict->FindEntry(name_);
         if (number == NameDictionary::kNotFound) return NOT_FOUND;
         number_ = static_cast<uint32_t>(number);