Follow-up for "Enable loads and stores to global vars through property cell shortcuts installed..."

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index 8a3d0a1febdebe758c1c02b6f163837d82894746..0bdde7482c509df9aed274e94738e701c3fb5935 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -432,8 +432,11 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalViaContext) {
 
   Handle<GlobalObject> global(script_context->global_object());
 
-  LookupIterator it(global, name, LookupIterator::OWN);
-  if (LookupIterator::DATA == it.state()) {
+  LookupIterator it(global, name, LookupIterator::HIDDEN);
+  // Switch to fast mode only if there is a data property and it's not on
+  // a hidden prototype.
+  if (LookupIterator::DATA == it.state() &&
+      it.GetHolder<Object>()->IsJSGlobalObject()) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(index, *cell);
@@ -464,8 +467,11 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalViaContext) {
 
   Handle<GlobalObject> global(script_context->global_object());
 
-  LookupIterator it(global, name, LookupIterator::OWN);
-  if (LookupIterator::DATA == it.state()) {
+  LookupIterator it(global, name, LookupIterator::HIDDEN);
+  // Switch to fast mode only if there is a data property and it's not on
+  // a hidden prototype.
+  if (LookupIterator::DATA == it.state() &&
+      it.GetHolder<Object>()->IsJSGlobalObject()) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(index, *cell);