This is a fix of issue http://b/issue?id=1381845....

src/handles.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 314 matching lines @@
       result = enum_fun(info);
     }
   }
   return result;
 }
 
 
 Handle<FixedArray> GetKeysInFixedArrayFor(Handle<JSObject> object) {
   Handle<FixedArray> content = Factory::empty_fixed_array();
 
-  // Check access rights if required.
-  if (object->IsAccessCheckNeeded() &&
-    !Top::MayNamedAccess(*object, Heap::undefined_value(), v8::ACCESS_KEYS)) {
-    Top::ReportFailedAccessCheck(*object, v8::ACCESS_KEYS);
-    return content;
-  }
-
   JSObject* arguments_boilerplate =
       Top::context()->global_context()->arguments_boilerplate();
   JSFunction* arguments_function =
       JSFunction::cast(arguments_boilerplate->map()->constructor());
   bool allow_enumeration = (object->map()->constructor() != arguments_function);
 
   // Only collect keys if access is permitted.
   if (allow_enumeration) {
     for (Handle<Object> p = object;
          *p != Heap::null_value();
          p = Handle<Object>(p->GetPrototype())) {
       Handle<JSObject> current(JSObject::cast(*p));
 
+      // Check access rights if required.
+      if (current->IsAccessCheckNeeded() &&
+        !Top::MayNamedAccess(*current, Heap::undefined_value(),
+                             v8::ACCESS_KEYS)) {
+        Top::ReportFailedAccessCheck(*current, v8::ACCESS_KEYS);
+        break;
+      }
+
       // Compute the property keys.
       content = UnionOfKeys(content, GetEnumPropertyKeys(current));
 
       // Add the property keys from the interceptor.
       if (current->HasNamedInterceptor()) {
         v8::Handle<v8::Array> result =
             GetKeysForNamedInterceptor(object, current);
         if (!result.IsEmpty())
           content = AddKeysFromJSArray(content, v8::Utils::OpenHandle(*result));
       }
@@ skipping 177 matching lines @@
                Handle<Context> security_context) {
   Handle<FixedArray> arr = Factory::NewFixedArray(4);
   arr->set(0, Smi::FromInt(index));
   arr->set(1, *compile_context);  // Compile in this context
   arr->set(2, *function_context);  // Set function context to this
   arr->set(3, *security_context);  // Receiver for call
   fun->shared()->set_lazy_load_data(*arr);
 }
 
 } }  // namespace v8::internal