Re-enable Object.observe and add enforcement for security invariants.

src/object-observe.js

Index: src/object-observe.js
diff --git a/src/object-observe.js b/src/object-observe.js
index e14614f86cc30cfb78b6800dfefc9c15d350e282..23c6bacd0f8383f3e8164407856a30365b9080ae 100644
--- a/src/object-observe.js
+++ b/src/object-observe.js
@@ -400,11 +400,9 @@ function ObserverEnqueueIfActive(observer, objectInfo, changeRecord,
   }
 
   var callback = ObserverGetCallback(observer);
-  if (needsAccessCheck &&
-      // Drop all splice records on the floor for access-checked objects
-      (changeRecord.type == 'splice' ||
-       !%IsAccessAllowedForObserver(
-           callback, changeRecord.object, changeRecord.name))) {
+  if (needsAccessCheck && !%IsAccessAllowedForObserver(callback,
+                                                       changeRecord.object,
+                                                       changeRecord)) {
     return;
   }
 
@@ -434,17 +432,14 @@ function ObjectInfoEnqueueExternalChangeRecord(objectInfo, changeRecord, type) {
   }
   ObjectFreeze(newRecord);
 
-  ObjectInfoEnqueueInternalChangeRecord(objectInfo, newRecord,
-                                        true /* skip access check */);
+  ObjectInfoEnqueueInternalChangeRecord(objectInfo, newRecord);
 }
 
-function ObjectInfoEnqueueInternalChangeRecord(objectInfo, changeRecord,
-                                               skipAccessCheck) {
+function ObjectInfoEnqueueInternalChangeRecord(objectInfo, changeRecord) {
   // TODO(rossberg): adjust once there is a story for symbols vs proxies.
   if (IS_SYMBOL(changeRecord.name)) return;
 
-  var needsAccessCheck = !skipAccessCheck &&
-      %IsAccessCheckNeeded(changeRecord.object);
+  var needsAccessCheck = %IsAccessCheckNeeded(changeRecord.object);

[rossberg, 2014/04/30 11:28:32]

I believe you always need to do the same-origin check. As Dan suggests, this
runtime function should go.

[rafaelw, 2014/05/02 03:22:32]

Done.

 
   if (ChangeObserversIsOptimized(objectInfo.changeObservers)) {
     var observer = objectInfo.changeObservers;
@@ -562,6 +557,8 @@ function ObjectGetNotifier(object) {
 
   if (ObjectIsFrozen(object)) return null;
 
+  if (!%ObjectWasCreatedInCurrentOrigin(object)) return null;
+
   var objectInfo = ObjectInfoGetOrCreate(object);
   return ObjectInfoGetNotifier(objectInfo);
 }
@@ -623,5 +620,4 @@ function SetupObjectObserve() {
   ));
 }
 
-// Disable Object.observe API for M35.
-// SetupObjectObserve();
+SetupObjectObserve();