Use GetProperty for getting elements.

src/lookup-inl.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_LOOKUP_INL_H_
 #define V8_LOOKUP_INL_H_
 
 #include "src/lookup.h"
 
 namespace v8 {
@@ skipping 40 matching lines @@
           IsIntegerIndexedExotic(holder)) {
         return INTEGER_INDEXED_EXOTIC;
       }
       if (check_interceptor() && HasInterceptor(map) &&
           !SkipInterceptor(JSObject::cast(holder))) {
         return INTERCEPTOR;
       }
     // Fall through.
     case INTERCEPTOR:
       if (IsElement()) {
+        // TODO(verwaest): Optimize.
         JSObject* js_object = JSObject::cast(holder);
         ElementsAccessor* accessor = js_object->GetElementsAccessor();
         FixedArrayBase* backing_store = js_object->elements();
         number_ = accessor->GetIndexForKey(backing_store, index_);
         if (number_ == kMaxUInt32) return NOT_FOUND;
+        if (accessor->GetAttributes(js_object, index_, backing_store) ==
+            ABSENT) {
+          return NOT_FOUND;
+        }
         property_details_ = accessor->GetDetails(backing_store, number_);
       } else if (map->is_dictionary_map()) {
         NameDictionary* dict = JSObject::cast(holder)->property_dictionary();
         int number = dict->FindEntry(name_);
         if (number == NameDictionary::kNotFound) return NOT_FOUND;
         number_ = static_cast<uint32_t>(number);
         if (holder->IsGlobalObject()) {
           DCHECK(dict->ValueAt(number_)->IsPropertyCell());
           PropertyCell* cell = PropertyCell::cast(dict->ValueAt(number_));
           if (cell->value()->IsTheHole()) return NOT_FOUND;
@@ skipping 38 matching lines @@
     default:
       return NOT_FOUND;
   }
   UNREACHABLE();
   return state_;
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_LOOKUP_INL_H_