[ic] Resurrect access checks for primitive and global proxy receivers.

src/ic/handler-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/handler-compiler.h"
 
 #include "src/field-type.h"
 #include "src/ic/call-optimization.h"
 #include "src/ic/handler-configuration-inl.h"
 #include "src/ic/ic-inl.h"
@@ skipping 80 matching lines @@
 }
 
 
 #define __ ACCESS_MASM(masm())
 
 
 Register NamedLoadHandlerCompiler::FrontendHeader(Register object_reg,
                                                   Handle<Name> name,
                                                   Label* miss,
                                                   ReturnHolder return_what) {
+  if (map()->IsPrimitiveMap() || map()->IsJSGlobalProxyMap()) {
+    // If the receiver is a global proxy and if we get to this point then
+    // the compile-time (current) native context has access to global proxy's
+    // native context. Since access rights revocation is not supported at all,
+    // we can generate a check that an execution-time native context is either
+    // the same as compile-time native context or has the same access token.
+    Handle<Context> native_context = isolate()->native_context();
+    Handle<WeakCell> weak_cell(native_context->self_weak_cell(), isolate());
+
+    bool compare_native_contexts_only = map()->IsPrimitiveMap();
+    GenerateAccessCheck(weak_cell, scratch1(), scratch2(), miss,
+                        compare_native_contexts_only);
+  }
+
   // Check that the maps starting from the prototype haven't changed.
   return CheckPrototypes(object_reg, scratch1(), scratch2(), scratch3(), name,
                          miss, return_what);
 }
 
 
 // Frontend for store uses the name register. It has to be restored before a
 // miss.
 Register NamedStoreHandlerCompiler::FrontendHeader(Register object_reg,
                                                    Handle<Name> name,
                                                    Label* miss,
                                                    ReturnHolder return_what) {
+  if (map()->IsJSGlobalProxyMap()) {
+    Handle<Context> native_context = isolate()->native_context();
+    Handle<WeakCell> weak_cell(native_context->self_weak_cell(), isolate());
+    GenerateAccessCheck(weak_cell, scratch1(), scratch2(), miss, false);
+  }
+
   return CheckPrototypes(object_reg, this->name(), scratch1(), scratch2(), name,
                          miss, return_what);
 }
 
 
 Register PropertyHandlerCompiler::Frontend(Handle<Name> name) {
   Label miss;
   if (IC::ShouldPushPopSlotAndVector(kind())) {
     PushVectorAndSlot();
   }
@@ skipping 524 matching lines @@
 }
 
 void ElementHandlerCompiler::CompileElementHandlers(
     MapHandleList* receiver_maps, List<Handle<Object>>* handlers) {
   for (int i = 0; i < receiver_maps->length(); ++i) {
     handlers->Add(GetKeyedLoadHandler(receiver_maps->at(i), isolate()));
   }
 }
 }  // namespace internal
 }  // namespace v8