[objects] Fix module namespace object element accesses

As of the normative change [1] of spec, the export name can be
arbitrary strings. Element accesses on module namespace objects
will be interpreted as indexed properties, so those element key
exports should be setup as elements.

[1]: https://github.com/tc39/ecma262/pull/2154

Bug: v8:11690
Change-Id: I3b724d11b9306739268fc5348bae87911a8da18c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3219945
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: legendecas <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#77581}

src/objects/js-objects-inl.h

@@ -717,8 +717,6 @@ Maybe<bool> JSReceiver::HasProperty(Handle<JSReceiver> object,
 
 Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
                                        uint32_t index) {
-  if (object->IsJSModuleNamespace()) return Just(false);
-
   if (object->IsJSObject()) {  // Shortcut.
     LookupIterator it(object->GetIsolate(), object, index, object,
                       LookupIterator::OWN);

src/objects/js-objects.cc

@@ -2581,6 +2581,20 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
   }
 }
 
+void JSObject::SetNormalizedElement(Handle<JSObject> object, uint32_t index,
+                                    Handle<Object> value,
+                                    PropertyDetails details) {
+  DCHECK_EQ(object->GetElementsKind(), DICTIONARY_ELEMENTS);
+
+  Isolate* isolate = object->GetIsolate();
+
+  Handle<NumberDictionary> dictionary =
+      handle(NumberDictionary::cast(object->elements()), isolate);
+  dictionary =
+      NumberDictionary::Set(isolate, dictionary, index, value, object, details);
+  object->set_elements(*dictionary);
+}
+
 void JSObject::JSObjectShortPrint(StringStream* accumulator) {
   switch (map().instance_type()) {
     case JS_ARRAY_TYPE: {

src/objects/js-objects.h

@@ -465,13 +465,9 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   static void SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
                                     Handle<Object> value,
                                     PropertyDetails details);
-  static void SetDictionaryElement(Handle<JSObject> object, uint32_t index,
+  static void SetNormalizedElement(Handle<JSObject> object, uint32_t index,
                                    Handle<Object> value,
-                                   PropertyAttributes attributes);
+                                   PropertyDetails details);
-  static void SetDictionaryArgumentsElement(Handle<JSObject> object,
-                                            uint32_t index,
-                                            Handle<Object> value,
-                                            PropertyAttributes attributes);
 
   static void OptimizeAsPrototype(Handle<JSObject> object,
                                   bool enable_setup_mode = true);

src/objects/module.cc

@@ -372,11 +372,19 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
   JSObject::NormalizeProperties(isolate, ns, CLEAR_INOBJECT_PROPERTIES,
                                 static_cast<int>(names.size()),
                                 "JSModuleNamespace");
+  JSObject::NormalizeElements(ns);
   for (const auto& name : names) {
+    uint32_t index = 0;
+    if (name->AsArrayIndex(&index)) {
+      JSObject::SetNormalizedElement(
+          ns, index, Accessors::MakeModuleNamespaceEntryInfo(isolate, name),
+          PropertyDetails(kAccessor, attr, PropertyCellType::kMutable));
+    } else {
       JSObject::SetNormalizedProperty(
           ns, name, Accessors::MakeModuleNamespaceEntryInfo(isolate, name),
           PropertyDetails(kAccessor, attr, PropertyCellType::kMutable));
     }
+  }
   JSObject::PreventExtensions(ns, kThrowOnError).ToChecked();
 
   // Optimize the namespace object as a prototype, for two reasons:

src/runtime/runtime-object.cc

@@ -360,10 +360,6 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
   Handle<Object> object = args.at(0);
 
   if (object->IsJSModuleNamespace()) {
-    if (key.is_element()) {
-      // Namespace objects can't have indexed properties.
-      return ReadOnlyRoots(isolate).false_value();
-    }
     LookupIterator it(isolate, object, key, LookupIterator::OWN);
     PropertyDescriptor desc;
     Maybe<bool> result = JSReceiver::GetOwnPropertyDescriptor(&it, &desc);

test/test262/test262.status

@@ -398,9 +398,6 @@
   # http://crbug/v8/11533
   'language/statements/class/subclass/default-constructor-spread-override': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=11690
-  'language/module-code/export-expname-binding-index': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=11111
   'built-ins/ArrayBuffer/prototype/transfer/*': [FAIL],
   'built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer': [PASS],