[crankshaft] Fix property access with proxies in prototype chain

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 5429 matching lines @@
                                               expr->pattern(),
                                               expr->flags(),
                                               expr->literal_index());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
 static bool CanInlinePropertyAccess(Handle<Map> map) {
   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
+  if (map->instance_type() == JS_PROXY_TYPE) return false;

[rossberg, 2015/04/16 10:54:13]

This isn't actually needed, I assume.

   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
          !map->has_named_interceptor() &&
          // TODO(verwaest): Whitelist contexts to which we have access.
          !map->is_access_check_needed();
 }
 
 
 // Determines whether the given array or object literal boilerplate satisfies
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
@@ skipping 602 matching lines @@
       JSObject::TryMigrateInstance(holder_);
     }
     map = Handle<Map>(holder_->map());
     if (!CanInlinePropertyAccess(map)) {
       NotFound();
       return false;
     }
     LookupDescriptor(*map, *name_);
     if (IsFound()) return LoadResult(map);
   }
+
+  if (map->IsJSReceiverMap()) {

[rossberg, 2015/04/16 10:54:13]

You may want to set NotFound in this case as well (you can just return
!map->IsJSReceiverMap() below).

+    return false;
+  }
   NotFound();
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsIntegerIndexedExotic() {
   InstanceType instance_type = map_->instance_type();
   return instance_type == JS_TYPED_ARRAY_TYPE &&
          IsSpecialIndex(isolate()->unicode_cache(), *name_);
 }
@@ skipping 6837 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal