Fix compat lookup stopping on an inherited property name

The depth walk in container.lookup tested `name in d`, which also matches
inherited properties. lookupProperty then denies access to them, so the walk
returned undefined from a depth that could not supply the name instead of
continuing to the parent depth that owned it. Any field named after an
Object.prototype member (toString, constructor, valueOf, hasOwnProperty)
stopped resolving in compat mode.

Testing with lookupProperty and falling back to hasOwnProperty keeps the
behaviour #2151 added, where an own property whose value is null or undefined
still wins over a parent depth, and keeps a prototype property that the
prototype access control allows.

Author: dylanpulver

lib/handlebars/runtime.js

@@ -146,8 +146,22 @@ export function template(templateSpec, env) {
         const d = depths[i];
         if (d == null) continue;
         if (typeof d === 'object' || typeof d === 'function') {
-          if (Utils.isMap(d) ? d.has(name) : name in d) {
-            return container.lookupProperty(d, name);
+          if (Utils.isMap(d)) {
+            if (d.has(name)) {
+              return container.lookupProperty(d, name);
+            }
+          } else {
+            // `name in d` would also match inherited properties, which
+            // lookupProperty then denies, stopping the walk on a depth that
+            // cannot supply the name. Own properties still win even when their
+            // value is null or undefined.
+            const result = container.lookupProperty(d, name);
+            if (
+              result !== undefined ||
+              Object.prototype.hasOwnProperty.call(d, name)
+            ) {
+              return result;
+            }
           }
         } else {
           const result = container.lookupProperty(d, name);

spec/blocks.js

@@ -266,6 +266,31 @@ describe('blocks', function () {
         .toCompileTo('');
     });
 
+    it('should find a parent value named like an Object.prototype member', function () {
+      expectTemplate('{{#each items}}{{constructor}}/{{valueOf}}{{/each}}')
+        .withCompileOptions({ compat: true })
+        .withInput({
+          constructor: 'root-constructor',
+          valueOf: 'root-valueOf',
+          items: [{ id: 1 }],
+        })
+        .toCompileTo('root-constructor/root-valueOf');
+    });
+
+    it('should stop at a depth whose match is an allowed prototype method', function () {
+      class Item {
+        greeting() {
+          return 'item-greeting';
+        }
+      }
+
+      expectTemplate('{{#each items}}{{greeting}}{{/each}}')
+        .withCompileOptions({ compat: true })
+        .withInput({ greeting: 'root-greeting', items: [new Item()] })
+        .withRuntimeOptions({ allowedProtoMethods: { greeting: true } })
+        .toCompileTo('item-greeting');
+    });
+
     it('block with deep recursive lookup lookup', function () {
       expectTemplate(
         '{{#outer}}Goodbye {{#inner}}cruel {{omg}}{{/inner}}{{/outer}}'