[proxies] fix access issue when having proxies on the prototype-chain of global objects.

src/prototype.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_PROTOTYPE_H_
 #define V8_PROTOTYPE_H_
 
 #include "src/isolate.h"
 #include "src/objects.h"
 
@@ skipping 45 matching lines @@
         isolate_(receiver_map->GetIsolate()) {}
 
   explicit PrototypeIterator(Handle<Map> receiver_map)
       : did_jump_to_prototype_chain_(true),
         object_(NULL),
         handle_(handle(receiver_map->prototype(), receiver_map->GetIsolate())),
         isolate_(receiver_map->GetIsolate()) {}
 
   ~PrototypeIterator() {}
 
+  const bool HasAccess() {
+    // We can only perform access check in the handlified version of the
+    // PrototypeIterator.
+    DCHECK(!handle_.is_null());
+    if (handle_->IsAccessCheckNeeded()) {
+      return isolate_->MayAccess(handle(isolate_->context()),
+                                 Handle<JSObject>::cast(handle_));
+    }
+    return true;
+  }
+
   template <typename T = Object>
   T* GetCurrent() const {
     DCHECK(handle_.is_null());
     return T::cast(object_);
   }
 
   template <typename T = Object>
   static Handle<T> GetCurrent(const PrototypeIterator& iterator) {
     DCHECK(!iterator.handle_.is_null());
+    DCHECK(iterator.object_ == NULL);
     return Handle<T>::cast(iterator.handle_);
   }
 
   void Advance() {
     if (handle_.is_null() && object_->IsJSProxy()) {
       did_jump_to_prototype_chain_ = true;
       object_ = isolate_->heap()->null_value();
       return;
     } else if (!handle_.is_null() && handle_->IsJSProxy()) {
       did_jump_to_prototype_chain_ = true;
@@ skipping 67 matching lines @@
 
   DISALLOW_COPY_AND_ASSIGN(PrototypeIterator);
 };
 
 
 }  // namespace internal
 
 }  // namespace v8
 
 #endif  // V8_PROTOTYPE_H_