Add access check for observed objects

src/object-observe.js

Index: src/object-observe.js
diff --git a/src/object-observe.js b/src/object-observe.js
index f5e0d9d563a08e0507d01b03cc519370e49d0215..f722df2276d2101d0b76166e9a7f9faea573f307 100644
--- a/src/object-observe.js
+++ b/src/object-observe.js
@@ -275,15 +275,25 @@ function EnqueueToCallback(callback, changeRecord) {
   %SetObserverDeliveryPending();
 }
 
-function EnqueueChangeRecord(changeRecord, observers) {
+function EnqueueChangeRecord(changeRecord, observers, skipAccessCheck) {
   // TODO(rossberg): adjust once there is a story for symbols vs proxies.
   if (IS_SYMBOL(changeRecord.name)) return;
 
+  var object = changeRecord.object;
+  var needsAccessCheck = !skipAccessCheck && %IsAccessCheckNeeded(object);
   for (var i = 0; i < observers.length; i++) {
     var observer = observers[i];
     if (IS_UNDEFINED(observer.accept[changeRecord.type]))
       continue;
 
+    if (needsAccessCheck &&
+        // Drop all splice records on the floor for access-checked objects
+        (changeRecord.type == 'splice' ||
+         !%GetAccessAllowedForObserver(
+             observer.callback, object, changeRecord.name))) {
+      continue;
+    }
+
     EnqueueToCallback(observer.callback, changeRecord);
   }
 }
@@ -354,7 +364,8 @@ function ObjectNotifierNotify(changeRecord) {
   }
   ObjectFreeze(newRecord);
 
-  EnqueueChangeRecord(newRecord, objectInfo.changeObservers);
+  EnqueueChangeRecord(newRecord, objectInfo.changeObservers,
+      true /* skip access check */);
 }
 
 function ObjectNotifierPerformChange(changeType, changeFn, receiver) {