Check holder before optimizing calls to global functions....

src/ast.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 600 matching lines @@
   }
 }
 
 
 bool Call::ComputeGlobalTarget(Handle<GlobalObject> global,
                                Handle<String> name) {
   target_ = Handle<JSFunction>::null();
   cell_ = Handle<JSGlobalPropertyCell>::null();
   LookupResult lookup;
   global->Lookup(*name, &lookup);
-  if (lookup.IsProperty() && lookup.type() == NORMAL) {
+  if (lookup.IsProperty() &&
+      lookup.type() == NORMAL &&
+      lookup.holder() == *global) {
     cell_ = Handle<JSGlobalPropertyCell>(global->GetPropertyCell(&lookup));
     if (cell_->value()->IsJSFunction()) {
       Handle<JSFunction> candidate(JSFunction::cast(cell_->value()));
       // If the function is in new space we assume it's more likely to
       // change and thus prefer the general IC code.
       if (!Heap::InNewSpace(*candidate) &&
           CanCallWithoutIC(candidate, arguments()->length())) {
         target_ = candidate;
         return true;
       }
@@ skipping 424 matching lines @@
 
 CaseClause::CaseClause(Expression* label,
                        ZoneList<Statement*>* statements,
                        int pos)
     : label_(label),
       statements_(statements),
       position_(pos),
       compare_type_(NONE) {}
 
 } }  // namespace v8::internal