add access checks to receivers on function callbacks

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 8641 matching lines @@
     CHECK(!isolate()->serializer_enabled());
     DCHECK_EQ(0, receiver_maps->length());
     receiver_maps->Add(handle(function->global_proxy()->map()), zone());
   }
   CallOptimization::HolderLookup holder_lookup =
       CallOptimization::kHolderNotFound;
   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
       receiver_maps->first(), &holder_lookup);
   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
 
+  // Don't inline calls to receivers requiring accesschecks.
+  for (int i = 0; i < receiver_maps->length(); ++i) {
+    if (receiver_maps->at(i)->is_access_check_needed()) return false;
+  }
+
   if (FLAG_trace_inlining) {
     PrintF("Inlining api function ");
     function->ShortPrint();
     PrintF("\n");
   }
 
   bool is_function = false;
   bool is_store = false;
   switch (call_type) {
     case kCallApiFunction:
@@ skipping 4717 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal