Index: src/ic/handler-compiler.cc |
diff --git a/src/ic/handler-compiler.cc b/src/ic/handler-compiler.cc |
index d36d66cc381da11580a1f59d56a942b9eed33d6c..05e9031915ac9ca4092939b77089a3676ef944a3 100644 |
--- a/src/ic/handler-compiler.cc |
+++ b/src/ic/handler-compiler.cc |
@@ -98,6 +98,20 @@ Register NamedLoadHandlerCompiler::FrontendHeader(Register object_reg, |
Handle<Name> name, |
Label* miss, |
ReturnHolder return_what) { |
+ if (map()->IsPrimitiveMap() || map()->IsJSGlobalProxyMap()) { |
+ // If the receiver is a global proxy and if we get to this point then |
+ // the compile-time (current) native context has access to global proxy's |
+ // native context. Since access rights revocation is not supported at all, |
+ // we can generate a check that an execution-time native context is either |
+ // the same as compile-time native context or has the same access token. |
+ Handle<Context> native_context = isolate()->native_context(); |
+ Handle<WeakCell> weak_cell(native_context->self_weak_cell(), isolate()); |
+ |
+ bool compare_native_contexts_only = map()->IsPrimitiveMap(); |
+ GenerateAccessCheck(weak_cell, scratch1(), scratch2(), miss, |
+ compare_native_contexts_only); |
+ } |
+ |
// Check that the maps starting from the prototype haven't changed. |
return CheckPrototypes(object_reg, scratch1(), scratch2(), scratch3(), name, |
miss, return_what); |
@@ -110,6 +124,12 @@ Register NamedStoreHandlerCompiler::FrontendHeader(Register object_reg, |
Handle<Name> name, |
Label* miss, |
ReturnHolder return_what) { |
+ if (map()->IsJSGlobalProxyMap()) { |
+ Handle<Context> native_context = isolate()->native_context(); |
+ Handle<WeakCell> weak_cell(native_context->self_weak_cell(), isolate()); |
+ GenerateAccessCheck(weak_cell, scratch1(), scratch2(), miss, false); |
+ } |
+ |
return CheckPrototypes(object_reg, this->name(), scratch1(), scratch2(), name, |
miss, return_what); |
} |