Fix access check in JSObject::PreventExtensions.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 433dda7d6f98daa1aac991c04413c4d3d4501bc8..a979f3ed8242deb7dd499acde4474fa67eff1abd 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6771,8 +6771,6 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
                                         ShouldThrow should_throw) {
   Isolate* isolate = object->GetIsolate();
 
-  if (!object->map()->is_extensible()) return Just(true);
-
   if (!object->HasSloppyArgumentsElements() && !object->map()->is_observed()) {
     return PreventExtensionsWithTransition<NONE>(object, should_throw);
   }
@@ -6786,6 +6784,8 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
                    NewTypeError(MessageTemplate::kNoAccess));
   }
 
+  if (!object->map()->is_extensible()) return Just(true);
+
   if (object->IsJSGlobalProxy()) {
     PrototypeIterator iter(isolate, object);
     if (iter.IsAtEnd()) return Just(true);
@@ -6887,6 +6887,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
                    NewTypeError(MessageTemplate::kNoAccess));
   }
 
+  if (attrs == NONE && !object->map()->is_extensible()) return Just(true);
+
   if (object->IsJSGlobalProxy()) {
     PrototypeIterator iter(isolate, object);
     if (iter.IsAtEnd()) return Just(true);