Merged r15610, r15723, r15724, r15725, r15728 into 3.18 branch.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index a7d8cbe4bedc41556423580d6b487ef6d00c285c..73a0e06a84b725b74d86b418a38493322bb473bb 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3012,7 +3012,6 @@ void JSObject::LocalLookupRealNamedProperty(Name* name, LookupResult* result) {
     Object* proto = GetPrototype();
     if (proto->IsNull()) return result->NotFound();
     ASSERT(proto->IsJSGlobalObject());
-    // A GlobalProxy's prototype should always be a proper JSObject.
     return JSObject::cast(proto)->LocalLookupRealNamedProperty(name, result);
   }
 
@@ -12164,6 +12163,13 @@ bool JSObject::HasRealElementProperty(Isolate* isolate, uint32_t index) {
     }
   }
 
+  if (IsJSGlobalProxy()) {
+    Object* proto = GetPrototype();
+    if (proto->IsNull()) return false;
+    ASSERT(proto->IsJSGlobalObject());
+    return JSObject::cast(proto)->HasRealElementProperty(isolate, index);
+  }
+
   return GetElementAttributeWithoutInterceptor(this, index, false) != ABSENT;
 }