Merge 95488 - Named property confusion with __proto__

Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp

Index: Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
===================================================================
--- Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp	(revision 96030)
+++ Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp	(working copy)
@@ -549,12 +549,17 @@
         return false;
 
     if (key->IsString()) {
+        DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));
+
         String name = toWebCoreString(key);
         // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
         // because that would generate infinite recursion.
         if (type == v8::ACCESS_HAS && target->tree()->child(name))
             return true;
-        if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()))
+        // We need to explicitly compare against nameOfProtoProperty because
+        // V8's JSObject::LocalLookup finds __proto__ before
+        // interceptors and even when __proto__ isn't a "real named property".
+        if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
             return true;
     }