[proxies] fix access issue when having proxies on the prototype-chain of global objects.

src/crankshaft/x64/lithium-codegen-x64.cc

Index: src/crankshaft/x64/lithium-codegen-x64.cc
diff --git a/src/crankshaft/x64/lithium-codegen-x64.cc b/src/crankshaft/x64/lithium-codegen-x64.cc
index 7dab9f4322a6a89387f94935da363e344e35006d..03c047d4e3da50805536f1f90e072f2704a4cea7 100644
--- a/src/crankshaft/x64/lithium-codegen-x64.cc
+++ b/src/crankshaft/x64/lithium-codegen-x64.cc
@@ -2599,8 +2599,16 @@ void LCodeGen::DoHasInPrototypeChainAndBranch(
   __ movp(object_map, FieldOperand(object, HeapObject::kMapOffset));
   Label loop;
   __ bind(&loop);
+
+
+  // Deoptimize if the object needs to be access checked.
+  __ testb(FieldOperand(object_map, Map::kBitFieldOffset),
+           Immediate(1 << Map::kIsAccessCheckNeeded));
+  DeoptimizeIf(not_zero, instr, Deoptimizer::kAccessCheck);
+  // Deoptimize for proxies.
   __ CmpInstanceType(object_map, JS_PROXY_TYPE);
   DeoptimizeIf(equal, instr, Deoptimizer::kProxy);
+
   __ movp(object_prototype, FieldOperand(object_map, Map::kPrototypeOffset));
   __ cmpp(object_prototype, prototype);
   EmitTrueBranch(instr, equal);