`in` operator not working correctly when using Proxy as VM context

[underflow00]

• Version: v12.13.1
• Platform: Windows 10

The in operator does not work correctly when using a Proxy as a VM context.

var o = {};
var p = new Proxy(o, {
    has(target, key) {
        console.log('has', key);
        return Reflect.has(target, key);
    },
    get(target, key, receiver) {
        console.log('get', key);
        return Reflect.get(target, key, receiver);
    },
});
vm.createContext(p);
vm.runInContext(`this.abcInThis = 'abc' in this`, p);
console.log(JSON.stringify(o)); // Prints {"abcInThis":false}

In the above code, the expected output is:

has abc
{"abcInThis":false}

but the actual output is:

get abc
{"abcInThis":true}

If we remove the get(target, key, receiver) function, the still incorrect output is:

{"abcInThis":false}

[devsnek]

This is a limitation of V8. See: #22390

I'd be interested in fixing this at some point.

[ExE-Boss]

This also causes issues when using the with operator, which prevents merging jsdom/webidl2js#167.

[devsnek]

I recently took a pretty deep dive into V8 internals to see what it would take to make fix this issue, and the quick answer is quite a lot. The good news is that V8 will need to update the internal global proxy infrastructure for the proposed realms api when they implement it, which will make it easier to fix this issue.

[ExE-Boss]

See also: #17465

[avivkeller]

const vm = require('vm');
var o = {};
var p = new Proxy(o, {
    has(target, key) {
        console.log('has', key);
        return Reflect.has(target, key);
    },
    get(target, key, receiver) {
        console.log('get', key);
        return Reflect.get(target, key, receiver);
    },
});
vm.createContext(p);
vm.runInContext(`this.abcInThis = 'abc' in this`, p);
console.log(JSON.stringify(o)); // Prints {"abcInThis":false}

get abc
{"abcInThis":true}

Still reproducible.

Sorry for the mis-close.