let load and store api callbacks use global proxy as receiver

src/stub-cache.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 593 matching lines @@
                                   Handle<JSObject> last,
                                   Handle<Name> name);
 
   void GenerateLoadField(Register reg,
                          Handle<JSObject> holder,
                          PropertyIndex field,
                          Representation representation);
   void GenerateLoadConstant(Handle<Object> value);
   void GenerateLoadCallback(Register reg,
                             Handle<ExecutableAccessorInfo> callback);
-  void GenerateLoadCallback(const CallOptimization& call_optimization);
+  void GenerateLoadCallback(const CallOptimization& call_optimization,
+                            Handle<Map> receiver_map);
   void GenerateLoadInterceptor(Register holder_reg,
                                Handle<Object> object,
                                Handle<JSObject> holder,
                                LookupResult* lookup,
                                Handle<Name> name);
   void GenerateLoadPostInterceptor(Register reg,
                                    Handle<JSObject> interceptor_holder,
                                    Handle<Name> name,
                                    LookupResult* lookup);
 
@@ skipping 195 matching lines @@
 
   enum HolderLookup {
     kHolderNotFound,
     kHolderIsReceiver,
     kHolderFound
   };
   Handle<JSObject> LookupHolderOfExpectedType(
       Handle<Map> receiver_map,
       HolderLookup* holder_lookup) const;
 
-  bool IsCompatibleReceiver(Object* receiver) {
-    ASSERT(is_simple_api_call());
-    if (expected_receiver_type_.is_null()) return true;
-    return expected_receiver_type_->IsTemplateFor(receiver);
-  }
+  // Check if the api holder is between the receiver and the holder.
+  bool IsCompatibleReceiver(Handle<Object> receiver,
+                            Handle<JSObject> holder) const;
 
  private:
   void Initialize(Handle<JSFunction> function);
 
   // Determines whether the given function can be called using the
   // fast api call builtin.
   void AnalyzePossibleApiFunction(Handle<JSFunction> function);
 
   Handle<JSFunction> constant_function_;
   bool is_simple_api_call_;
   Handle<FunctionTemplateInfo> expected_receiver_type_;
   Handle<CallHandlerInfo> api_call_info_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_STUB_CACHE_H_