[stubs] Also handle properties of the JSBuiltinsObject in the fast case.

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug.h"
 #include "src/messages.h"
@@ skipping 419 matching lines @@
 
   // Lookup the named property on the global object.
   Handle<ScopeInfo> scope_info(ScopeInfo::cast(script_context->extension()),
                                isolate);
   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
 
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update the cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);
   } else {
     // This is not a fast case, so keep this access in a slow mode.
     // Store empty_property_cell here to release the outdated property cell.
     script_context->set(slot, isolate->heap()->empty_property_cell());
   }
 
   Handle<Object> result;
@@ skipping 10 matching lines @@
   Handle<Context> script_context(isolate->context()->script_context(), isolate);
   DCHECK(script_context->IsScriptContext());
   DCHECK(script_context->get(slot)->IsPropertyCell());
 
   // Lookup the named property on the global object.
   Handle<ScopeInfo> scope_info(ScopeInfo::cast(script_context->extension()),
                                isolate);
   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
+
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);
   } else {
     // This is not a fast case, so keep this access in a slow mode.
     // Store empty_property_cell here to release the outdated property cell.
     script_context->set(slot, isolate->heap()->empty_property_cell());
   }
 
   Handle<Object> result;
@@ skipping 969 matching lines @@
   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 
   RETURN_FAILURE_ON_EXCEPTION(
       isolate,
       JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
                                setter, attrs));
   return isolate->heap()->undefined_value();
 }
 }  // namespace internal
 }  // namespace v8