Fix bugs 992, 1083 and 1092

src/handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 855 matching lines @@
   if (result) PROFILE(FunctionCreateEvent(*function));
   return result;
 }
 
 
 OptimizedObjectForAddingMultipleProperties::
 OptimizedObjectForAddingMultipleProperties(Handle<JSObject> object,
                                            int expected_additional_properties,
                                            bool condition) {
   object_ = object;
-  if (condition && object_->HasFastProperties()) {
+  if (condition && object_->HasFastProperties() && !object->IsJSGlobalProxy()) {
     // Normalize the properties of object to avoid n^2 behavior
     // when extending the object multiple properties. Indicate the number of
     // properties to be added.
     unused_property_fields_ = object->map()->unused_property_fields();
     NormalizeProperties(object_,
                         KEEP_INOBJECT_PROPERTIES,
                         expected_additional_properties);
     has_been_transformed_ = true;
 
   } else {
     has_been_transformed_ = false;
   }
 }
 
 
 OptimizedObjectForAddingMultipleProperties::
 ~OptimizedObjectForAddingMultipleProperties() {
   // Reoptimize the object to allow fast property access.
   if (has_been_transformed_) {
     TransformToFastProperties(object_, unused_property_fields_);
   }
 }
 
 } }  // namespace v8::internal