Fix keyed access of primitive objects in the runtime.

src/lookup.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_LOOKUP_H_
 #define V8_LOOKUP_H_
 
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects.h"
@@ skipping 38 matching lines @@
       : configuration_(ComputeConfiguration(configuration, name)),
         state_(NOT_FOUND),
         exotic_index_state_(ExoticIndexState::kUninitialized),
         interceptor_state_(InterceptorState::kUninitialized),
         property_details_(PropertyDetails::Empty()),
         isolate_(name->GetIsolate()),
         name_(Name::Flatten(name)),
         // kMaxUInt32 isn't a valid index.
         index_(kMaxUInt32),
         receiver_(receiver),
-        holder_(GetRoot(receiver_, isolate_)),
+        holder_(GetRoot(isolate_, receiver)),
         holder_map_(holder_->map(), isolate_),
         initial_holder_(holder_),
         number_(DescriptorArray::kNotFound) {
 #ifdef DEBUG
     uint32_t index;  // Assert that the name is not an array index.
     DCHECK(!name->AsArrayIndex(&index));
 #endif  // DEBUG
     Next();
   }
 
@@ skipping 25 matching lines @@
                  Configuration configuration = DEFAULT)
       : configuration_(configuration),
         state_(NOT_FOUND),
         exotic_index_state_(ExoticIndexState::kUninitialized),
         interceptor_state_(InterceptorState::kUninitialized),
         property_details_(PropertyDetails::Empty()),
         isolate_(isolate),
         name_(),
         index_(index),
         receiver_(receiver),
-        holder_(GetRoot(receiver_, isolate_)),
+        holder_(GetRoot(isolate, receiver, index)),
         holder_map_(holder_->map(), isolate_),
         initial_holder_(holder_),
         number_(DescriptorArray::kNotFound) {
     // kMaxUInt32 isn't a valid index.
     DCHECK_NE(kMaxUInt32, index_);
     Next();
   }
 
   LookupIterator(Isolate* isolate, Handle<Object> receiver, uint32_t index,
                  Handle<JSReceiver> holder,
@@ skipping 73 matching lines @@
   bool is_dictionary_holder() const { return holder_map_->is_dictionary_map(); }
   Handle<Map> transition_map() const {
     DCHECK_EQ(TRANSITION, state_);
     return Handle<Map>::cast(transition_);
   }
   template <class T>
   Handle<T> GetHolder() const {
     DCHECK(IsFound());
     return Handle<T>::cast(holder_);
   }
-  static Handle<JSReceiver> GetRoot(Handle<Object> receiver, Isolate* isolate);
+  static Handle<JSReceiver> GetRoot(Isolate* isolate, Handle<Object> receiver,
+                                    uint32_t index = kMaxUInt32);
   bool HolderIsReceiverOrHiddenPrototype() const;
 
   /* ACCESS_CHECK */
   bool HasAccess() const;
 
   /* PROPERTY */
   void PrepareForDataProperty(Handle<Object> value);
   void PrepareTransitionToDataProperty(Handle<Object> value,
                                        PropertyAttributes attributes,
                                        Object::StoreFromKeyed store_mode);
@@ skipping 98 matching lines @@
   Handle<JSReceiver> holder_;
   Handle<Map> holder_map_;
   const Handle<JSReceiver> initial_holder_;
   uint32_t number_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_LOOKUP_H_