Make sure that we can't access hidden properties by installing accessors on Object.prototype.

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 9417)
+++ src/objects.cc	(working copy)
@@ -3267,6 +3267,13 @@
             isolate->context()->global_context()->object_function());
         if (!maybe_obj->ToObject(&hidden_obj)) return maybe_obj;
       }
+      // Don't allow leakage of the hidden object through accessors
+      // on Object.prototype.
+      {
+        MaybeObject* maybe_obj =
+            JSObject::cast(hidden_obj)->SetPrototype(heap->null_value(), false);
+        if (maybe_obj->IsFailure()) return maybe_obj;
+      }
       return obj->SetHiddenPropertiesObject(hidden_obj);
     } else {
       return heap->undefined_value();