| Index: src/objects.cc
 | 
| ===================================================================
 | 
| --- src/objects.cc	(revision 9511)
 | 
| +++ src/objects.cc	(working copy)
 | 
| @@ -545,7 +545,9 @@
 | 
|    // holder in the prototype chain.
 | 
|    // Proxy handlers do not use the proxy's prototype, so we can skip this.
 | 
|    if (!result->IsHandler()) {
 | 
| -    Object* last = result->IsProperty() ? result->holder() : heap->null_value();
 | 
| +    Object* last = result->IsProperty()
 | 
| +        ? result->holder()
 | 
| +        : Object::cast(heap->null_value());
 | 
|      ASSERT(this != this->GetPrototype());
 | 
|      for (Object* current = this; true; current = current->GetPrototype()) {
 | 
|        if (current->IsAccessCheckNeeded()) {
 | 
| 
 |