Do proper security checks when accessing elements with getOwnPropertyDescriptor.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 8bced586b39dd4938495750421ef15bc3ae3c6a6..1ccb1424b51ecef6ef81518f0f7522bd81558e96 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6679,6 +6679,13 @@ JSObject::LocalElementType JSObject::HasLocalElement(uint32_t index) {
     return UNDEFINED_ELEMENT;
   }
 
+  if (IsJSGlobalProxy()) {
+    Object* proto = GetPrototype();
+    if (proto->IsNull()) return UNDEFINED_ELEMENT;
+    ASSERT(proto->IsJSGlobalObject());
+    return JSObject::cast(proto)->HasLocalElement(index);
+  }
+
   // Check for lookup interceptor
   if (HasIndexedInterceptor()) {
     return HasElementWithInterceptor(this, index) ? INTERCEPTED_ELEMENT