[crankshaft] Fix property access with proxies in prototype chain

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 393e02c9f97ba6381ad0697aa220dfe2df319d63..f28d4f9519e99a72f449a75c29d98676edaa79ce 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5447,6 +5447,7 @@ void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
 static bool CanInlinePropertyAccess(Handle<Map> map) {
   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
+  if (map->instance_type() == JS_PROXY_TYPE) return false;

[rossberg, 2015/04/16 10:54:13]

This isn't actually needed, I assume.

   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
          !map->has_named_interceptor() &&
          // TODO(verwaest): Whitelist contexts to which we have access.
@@ -6069,6 +6070,10 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
     LookupDescriptor(*map, *name_);
     if (IsFound()) return LoadResult(map);
   }
+
+  if (map->IsJSReceiverMap()) {

[rossberg, 2015/04/16 10:54:13]

You may want to set NotFound in this case as well (you can just return
!map->IsJSReceiverMap() below).

+    return false;
+  }
   NotFound();
   return true;
 }