[runtime] Make sure that LookupIterator::OWN always performs a HIDDEN lookup as well.

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index 853ed0580a76c82a3d567aaad5c558cce223b4ea..c22c44ffcc3d9418933c4edb5239e003772fc623 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -637,17 +637,7 @@ bool LookupIterator::SkipInterceptor(JSObject* holder) {
 JSReceiver* LookupIterator::NextHolder(Map* map) {
   DisallowHeapAllocation no_gc;
   if (map->prototype() == heap()->null_value()) return NULL;
-
-  DCHECK(!map->IsJSGlobalProxyMap() || map->has_hidden_prototype());
-
-  if (!check_prototype_chain() &&
-      !(check_hidden() && map->has_hidden_prototype()) &&
-      // Always lookup behind the JSGlobalProxy into the JSGlobalObject, even
-      // when not checking other hidden prototypes.
-      !map->IsJSGlobalProxyMap()) {
-    return NULL;
-  }
-
+  if (!check_prototype_chain() && !map->has_hidden_prototype()) return NULL;
   return JSReceiver::cast(map->prototype());
 }