[runtime] Make sure that LookupIterator::OWN always performs a HIDDEN lookup as well.

src/compiler/js-global-object-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-global-object-specialization.h"
 
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-graph.h"
@@ skipping 56 matching lines @@
         javascript()->LoadContext(0, result.index, result.immutable), context,
         context, effect);
     ReplaceWithValue(node, value, effect);
     return Replace(value);
   }
 
   // Lookup on the global object instead.  We only deal with own data
   // properties of the global object here (represented as PropertyCell).
   LookupIterator it(global_object, name, LookupIterator::OWN);
   if (it.state() != LookupIterator::DATA) return NoChange();
+  if (!it.GetHolder<JSObject>()->IsJSGlobalObject()) return NoChange();
   Handle<PropertyCell> property_cell = it.GetPropertyCell();
   PropertyDetails property_details = property_cell->property_details();
   Handle<Object> property_cell_value(property_cell->value(), isolate());
 
   // Load from non-configurable, read-only data property on the global
   // object can be constant-folded, even without deoptimization support.
   if (!property_details.IsConfigurable() && property_details.IsReadOnly()) {
     Node* value = jsgraph()->Constant(property_cell_value);
     ReplaceWithValue(node, value);
     return Replace(value);
@@ skipping 60 matching lines @@
     effect = graph()->NewNode(javascript()->StoreContext(0, result.index),
                               context, value, context, effect, control);
     ReplaceWithValue(node, value, effect, control);
     return Replace(value);
   }
 
   // Lookup on the global object instead.  We only deal with own data
   // properties of the global object here (represented as PropertyCell).
   LookupIterator it(global_object, name, LookupIterator::OWN);
   if (it.state() != LookupIterator::DATA) return NoChange();
+  if (!it.GetHolder<JSObject>()->IsJSGlobalObject()) return NoChange();
   Handle<PropertyCell> property_cell = it.GetPropertyCell();
   PropertyDetails property_details = property_cell->property_details();
   Handle<Object> property_cell_value(property_cell->value(), isolate());
 
   // Don't even bother trying to lower stores to read-only data properties.
   if (property_details.IsReadOnly()) return NoChange();
   switch (property_details.cell_type()) {
     case PropertyCellType::kUndefined: {
       return NoChange();
     }
@@ skipping 106 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSGlobalObjectSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8