Fix keyed access of primitive objects in the runtime.

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index be18b3b7a182f010a177b875ab000002d4b8a31a..aa0c8a67b4808bb3a84da8bcc2743482d1a25752 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -59,13 +59,23 @@ void LookupIterator::RestartLookupForNonMaskingInterceptors() {
 }
 
 
-Handle<JSReceiver> LookupIterator::GetRoot(Handle<Object> receiver,
-                                           Isolate* isolate) {
-  if (receiver->IsJSReceiver()) return Handle<JSReceiver>::cast(receiver);
-  auto root = handle(receiver->GetRootMap(isolate)->prototype(), isolate);
+Handle<JSReceiver> LookupIterator::GetRoot() {

[Igor Sheludko, 2015/07/10 10:02:42]

I think it is better to keep GetRoot() static given that you call it during
object construction. You just need an additional parameter "bool is_element".

+  if (receiver_->IsJSReceiver()) return Handle<JSReceiver>::cast(receiver_);
+  // Strings are the only objects with properties (only elements) directly on
+  // the wrapper. Hence we can skip generating the wrapper for all other cases.
+  if (IsElement() && receiver_->IsString() &&
+      index_ < static_cast<uint32_t>(String::cast(*receiver_)->length())) {
+    // TODO(verwaest): Speed this up. Perhaps use a cached wrapper on the native
+    // context, ensuring that we don't leak it into JS?
+    Handle<JSFunction> constructor = isolate_->string_function();
+    Handle<JSObject> result = factory()->NewJSObject(constructor);
+    Handle<JSValue>::cast(result)->set_value(*receiver_);
+    return result;
+  }
+  auto root = handle(receiver_->GetRootMap(isolate_)->prototype(), isolate_);
   if (root->IsNull()) {
     unsigned int magic = 0xbbbbbbbb;
-    isolate->PushStackTraceAndDie(magic, *receiver, NULL, magic);
+    isolate_->PushStackTraceAndDie(magic, *receiver_, NULL, magic);
   }
   return Handle<JSReceiver>::cast(root);
 }