| Index: src/ic.cc
 | 
| ===================================================================
 | 
| --- src/ic.cc	(revision 2408)
 | 
| +++ src/ic.cc	(working copy)
 | 
| @@ -452,24 +452,26 @@
 | 
|        }
 | 
|        case NORMAL: {
 | 
|          if (!object->IsJSObject()) return;
 | 
| -        if (object->IsGlobalObject()) {
 | 
| -          // The stub generated for the global object picks the value directly
 | 
| -          // from the property cell. So the property must be directly on the
 | 
| -          // global object.
 | 
| -          Handle<GlobalObject> global = Handle<GlobalObject>::cast(object);
 | 
| -          if (lookup->holder() != *global) return;
 | 
| +        Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 | 
| +
 | 
| +        if (lookup->holder()->IsGlobalObject()) {
 | 
| +          GlobalObject* global = GlobalObject::cast(lookup->holder());
 | 
|            JSGlobalPropertyCell* cell =
 | 
|                JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
 | 
|            if (!cell->value()->IsJSFunction()) return;
 | 
|            JSFunction* function = JSFunction::cast(cell->value());
 | 
| -          code = StubCache::ComputeCallGlobal(argc, in_loop, *name, *global,
 | 
| -                                              cell, function);
 | 
| +          code = StubCache::ComputeCallGlobal(argc,
 | 
| +                                              in_loop,
 | 
| +                                              *name,
 | 
| +                                              *receiver,
 | 
| +                                              global,
 | 
| +                                              cell,
 | 
| +                                              function);
 | 
|          } else {
 | 
|            // There is only one shared stub for calling normalized
 | 
|            // properties. It does not traverse the prototype chain, so the
 | 
|            // property must be found in the receiver for the stub to be
 | 
|            // applicable.
 | 
| -          Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 | 
|            if (lookup->holder() != *receiver) return;
 | 
|            code = StubCache::ComputeCallNormal(argc, in_loop, *name, *receiver);
 | 
|          }
 | 
| @@ -657,16 +659,15 @@
 | 
|          break;
 | 
|        }
 | 
|        case NORMAL: {
 | 
| -        if (object->IsGlobalObject()) {
 | 
| -          // The stub generated for the global object picks the value directly
 | 
| -          // from the property cell. So the property must be directly on the
 | 
| -          // global object.
 | 
| -          Handle<GlobalObject> global = Handle<GlobalObject>::cast(object);
 | 
| -          if (lookup->holder() != *global) return;
 | 
| +        if (lookup->holder()->IsGlobalObject()) {
 | 
| +          GlobalObject* global = GlobalObject::cast(lookup->holder());
 | 
|            JSGlobalPropertyCell* cell =
 | 
|                JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
 | 
| -          code = StubCache::ComputeLoadGlobal(*name, *global,
 | 
| -                                              cell, lookup->IsDontDelete());
 | 
| +          code = StubCache::ComputeLoadGlobal(*name,
 | 
| +                                              *receiver,
 | 
| +                                              global,
 | 
| +                                              cell,
 | 
| +                                              lookup->IsDontDelete());
 | 
|          } else {
 | 
|            // There is only one shared stub for loading normalized
 | 
|            // properties. It does not traverse the prototype chain, so the
 | 
| 
 |