`in` operator not working correctly when using Proxy as VM context

• Version: v12.13.1
• Platform: Windows 10

The in operator does not work correctly when using a Proxy as a VM context.

var o = {};
var p = new Proxy(o, {
    has(target, key) {
        console.log('has', key);
        return Reflect.has(target, key);
    },
    get(target, key, receiver) {
        console.log('get', key);
        return Reflect.get(target, key, receiver);
    },
});
vm.createContext(p);
vm.runInContext(`this.abcInThis = 'abc' in this`, p);
console.log(JSON.stringify(o)); // Prints {"abcInThis":false}

In the above code, the expected output is:

has abc
{"abcInThis":false}

but the actual output is:

get abc
{"abcInThis":true}

If we remove the get(target, key, receiver) function, the still incorrect output is:

{"abcInThis":false}

首先通过 vm.createContext 和 vm.runInContext 重现提供的 Proxy 示例，然后阅读 VM context 的实现及其对属性检查和访问的处理。完成标准是 in 运算符调用 Proxy 的 has trap，并且观测到的输出与预期行为一致，同时为该示例提供回归覆盖。