Introduce a PrototypeIterator template and use it all over the place

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 9d0dec6819881657897f597b45373f13d1784bb8..a2a0795079525492a8df640c245b705cebb438dc 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -801,30 +801,27 @@ MaybeHandle<Object> Object::GetElementWithReceiver(Isolate* isolate,
                                                    Handle<Object> object,
                                                    Handle<Object> receiver,
                                                    uint32_t index) {
-  Handle<Object> holder;
-
   // Iterate up the prototype chain until an element is found or the null
   // prototype is encountered.
-  for (holder = object;
-       !holder->IsNull();
-       holder = Handle<Object>(holder->GetPrototype(isolate), isolate)) {
-    if (!holder->IsJSObject()) {
-      if (holder->IsJSProxy()) {
+  for (PrototypeIterator<STORE_AS_HANDLE, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(isolate, object); !iter.IsAtEnd(); iter.Advance()) {
+    if (!iter.GetCurrent()->IsJSObject()) {
+      if (iter.GetCurrent()->IsJSProxy()) {
         return JSProxy::GetElementWithHandler(
-            Handle<JSProxy>::cast(holder), receiver, index);
-      } else if (holder->IsUndefined()) {
+            Handle<JSProxy>::cast(iter.GetCurrent()), receiver, index);
+      } else if (iter.GetCurrent()->IsUndefined()) {
         // Undefined has no indexed properties.
         return isolate->factory()->undefined_value();
       } else {
-        holder = Handle<Object>(holder->GetPrototype(isolate), isolate);
-        ASSERT(holder->IsJSObject());
+        iter.Advance();
+        ASSERT(iter.GetCurrent()->IsJSObject());
       }
     }
 
     // Inline the case for JSObjects. Doing so significantly improves the
     // performance of fetching elements where checking the prototype chain is
     // necessary.
-    Handle<JSObject> js_object = Handle<JSObject>::cast(holder);
+    Handle<JSObject> js_object = Handle<JSObject>::cast(iter.GetCurrent());
 
     // Check access rights if needed.
     if (js_object->IsAccessCheckNeeded()) {
@@ -888,7 +885,7 @@ Object* Object::GetPrototype(Isolate* isolate) {
 
 Handle<Object> Object::GetPrototype(Isolate* isolate,
                                     Handle<Object> object) {
-  return handle(object->GetPrototype(isolate), isolate);
+  return handle(SAFE_GET_PROTOTYPE(isolate, *object), isolate);
 }
 
 
@@ -2974,12 +2971,12 @@ MaybeHandle<Object> JSObject::SetElementWithCallbackSetterInPrototypes(
     bool* found,
     StrictMode strict_mode) {
   Isolate *isolate = object->GetIsolate();
-  for (Handle<Object> proto = handle(object->GetPrototype(), isolate);
-       !proto->IsNull();
-       proto = handle(proto->GetPrototype(isolate), isolate)) {
-    if (proto->IsJSProxy()) {
+  for (PrototypeIterator<STORE_AS_HANDLE, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(isolate, handle(SAFE_GET_PROTOTYPE(isolate, *object), isolate));
+       !iter.IsAtEnd(); iter.Advance()) {
+    if (iter.GetCurrent()->IsJSProxy()) {
       return JSProxy::SetPropertyViaPrototypesWithHandler(
-          Handle<JSProxy>::cast(proto),
+          Handle<JSProxy>::cast(iter.GetCurrent()),
           object,
           isolate->factory()->Uint32ToString(index),  // name
           value,
@@ -2987,7 +2984,7 @@ MaybeHandle<Object> JSObject::SetElementWithCallbackSetterInPrototypes(
           strict_mode,
           found);
     }
-    Handle<JSObject> js_proto = Handle<JSObject>::cast(proto);
+    Handle<JSObject> js_proto = Handle<JSObject>::cast(iter.GetCurrent());
     if (!js_proto->HasDictionaryElements()) {
       continue;
     }
@@ -3406,7 +3403,7 @@ void JSObject::LookupOwnRealNamedProperty(Handle<Name> name,
                                           LookupResult* result) {
   DisallowHeapAllocation no_gc;
   if (IsJSGlobalProxy()) {
-    Object* proto = GetPrototype();
+    Object* proto = SAFE_GET_PROTOTYPE_FAST(this);
     if (proto->IsNull()) return result->NotFound();
     ASSERT(proto->IsJSGlobalObject());
     return JSObject::cast(proto)->LookupOwnRealNamedProperty(name, result);
@@ -3465,14 +3462,13 @@ void JSObject::LookupRealNamedPropertyInPrototypes(Handle<Name> name,
                                                    LookupResult* result) {
   DisallowHeapAllocation no_gc;
   Isolate* isolate = GetIsolate();
-  Heap* heap = isolate->heap();
-  for (Object* pt = GetPrototype();
-       pt != heap->null_value();
-       pt = pt->GetPrototype(isolate)) {
-    if (pt->IsJSProxy()) {
-      return result->HandlerResult(JSProxy::cast(pt));
+  for (PrototypeIterator<STORE_AS_POINTER, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(isolate, SAFE_GET_PROTOTYPE_FAST(this)); !iter.IsAtEnd();
+       iter.Advance()) {
+    if (iter.GetCurrent()->IsJSProxy()) {
+      return result->HandlerResult(JSProxy::cast(iter.GetCurrent()));
     }
-    JSObject::cast(pt)->LookupOwnRealNamedProperty(name, result);
+    JSObject::cast(iter.GetCurrent())->LookupOwnRealNamedProperty(name, result);
     ASSERT(!(result->IsFound() && result->type() == INTERCEPTOR));
     if (result->IsFound()) return;
   }
@@ -4040,7 +4036,7 @@ MaybeHandle<Object> JSObject::SetPropertyForResult(
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return value;
     ASSERT(proto->IsJSGlobalObject());
     return SetPropertyForResult(Handle<JSObject>::cast(proto),
@@ -4180,7 +4176,7 @@ MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes(
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return value;
     ASSERT(proto->IsJSGlobalObject());
     return SetOwnPropertyIgnoreAttributes(Handle<JSObject>::cast(proto),
@@ -4413,7 +4409,7 @@ PropertyAttributes JSObject::GetElementAttributeWithReceiver(
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return ABSENT;
     ASSERT(proto->IsJSGlobalObject());
     return JSObject::GetElementAttributeWithReceiver(
@@ -4485,7 +4481,7 @@ PropertyAttributes JSObject::GetElementAttributeWithoutInterceptor(
 
   if (!check_prototype) return ABSENT;
 
-  Handle<Object> proto(object->GetPrototype(), object->GetIsolate());
+  Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), object->GetIsolate());
   if (proto->IsJSProxy()) {
     // We need to follow the spec and simulate a call to [[GetOwnProperty]].
     return JSProxy::GetElementAttributeWithHandler(
@@ -4955,7 +4951,7 @@ Object* JSObject::GetHiddenProperty(Handle<Name> key) {
     // JSGlobalProxies store their hash internally.
     ASSERT(*key != GetHeap()->identity_hash_string());
     // For a proxy, use the prototype as target object.
-    Object* proxy_parent = GetPrototype();
+    Object* proxy_parent = SAFE_GET_PROTOTYPE_FAST(this);
     // If the proxy is detached, return undefined.
     if (proxy_parent->IsNull()) return GetHeap()->the_hole_value();
     ASSERT(proxy_parent->IsJSGlobalObject());
@@ -4991,7 +4987,7 @@ Handle<Object> JSObject::SetHiddenProperty(Handle<JSObject> object,
     // JSGlobalProxies store their hash internally.
     ASSERT(*key != *isolate->factory()->identity_hash_string());
     // For a proxy, use the prototype as target object.
-    Handle<Object> proxy_parent(object->GetPrototype(), isolate);
+    Handle<Object> proxy_parent(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     // If the proxy is detached, return undefined.
     if (proxy_parent->IsNull()) return isolate->factory()->undefined_value();
     ASSERT(proxy_parent->IsJSGlobalObject());
@@ -5030,7 +5026,7 @@ void JSObject::DeleteHiddenProperty(Handle<JSObject> object, Handle<Name> key) {
   ASSERT(key->IsUniqueName());
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return;
     ASSERT(proto->IsJSGlobalObject());
     return DeleteHiddenProperty(Handle<JSObject>::cast(proto), key);
@@ -5273,7 +5269,7 @@ MaybeHandle<Object> JSObject::DeleteElement(Handle<JSObject> object,
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return factory->false_value();
     ASSERT(proto->IsJSGlobalObject());
     return DeleteElement(Handle<JSObject>::cast(proto), index, mode);
@@ -5328,7 +5324,7 @@ MaybeHandle<Object> JSObject::DeleteProperty(Handle<JSObject> object,
   }
 
   if (object->IsJSGlobalProxy()) {
-    Object* proto = object->GetPrototype();
+    Object* proto = SAFE_GET_PROTOTYPE_FAST(*object);
     if (proto->IsNull()) return isolate->factory()->false_value();
     ASSERT(proto->IsJSGlobalObject());
     return JSGlobalObject::DeleteProperty(
@@ -5562,7 +5558,7 @@ MaybeHandle<Object> JSObject::PreventExtensions(Handle<JSObject> object) {
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return object;
     ASSERT(proto->IsJSGlobalObject());
     return PreventExtensions(Handle<JSObject>::cast(proto));
@@ -5644,7 +5640,7 @@ MaybeHandle<Object> JSObject::Freeze(Handle<JSObject> object) {
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return object;
     ASSERT(proto->IsJSGlobalObject());
     return Freeze(Handle<JSObject>::cast(proto));
@@ -6033,12 +6029,10 @@ Handle<Object> JSObject::GetDataProperty(Handle<JSObject> object,
 // - This object has no elements.
 // - No prototype has enumerable properties/elements.
 bool JSReceiver::IsSimpleEnum() {
-  Heap* heap = GetHeap();
-  for (Object* o = this;
-       o != heap->null_value();
-       o = JSObject::cast(o)->GetPrototype()) {
-    if (!o->IsJSObject()) return false;
-    JSObject* curr = JSObject::cast(o);
+  for (PrototypeIterator<STORE_AS_POINTER, MAP_BASED_WALK, END_AT_NULL_VALUE>
+           iter(this); !iter.IsAtEnd(); iter.Advance()) {
+    if (!iter.GetCurrent()->IsJSObject()) return false;
+    JSObject* curr = JSObject::cast(iter.GetCurrent());
     int enum_length = curr->map()->EnumLength();
     if (enum_length == kInvalidEnumCacheSentinel) return false;
     if (curr->IsAccessCheckNeeded()) return false;
@@ -6106,7 +6100,7 @@ void JSReceiver::LookupOwn(
   ASSERT(name->IsName());
 
   if (IsJSGlobalProxy()) {
-    Object* proto = GetPrototype();
+    Object* proto = SAFE_GET_PROTOTYPE_FAST(this);
     if (proto->IsNull()) return result->NotFound();
     ASSERT(proto->IsJSGlobalObject());
     return JSReceiver::cast(proto)->LookupOwn(
@@ -6136,7 +6130,7 @@ void JSReceiver::LookupOwn(
   js_object->LookupOwnRealNamedProperty(name, result);
   if (result->IsFound() || !search_hidden_prototypes) return;
 
-  Object* proto = js_object->GetPrototype();
+  Object* proto = SAFE_GET_PROTOTYPE_FAST(js_object);
   if (!proto->IsJSReceiver()) return;
   JSReceiver* receiver = JSReceiver::cast(proto);
   if (receiver->map()->is_hidden_prototype()) {
@@ -6148,11 +6142,9 @@ void JSReceiver::LookupOwn(
 void JSReceiver::Lookup(Handle<Name> name, LookupResult* result) {
   DisallowHeapAllocation no_gc;
   // Ecma-262 3rd 8.6.2.4
-  Handle<Object> null_value = GetIsolate()->factory()->null_value();
-  for (Object* current = this;
-       current != *null_value;
-       current = JSObject::cast(current)->GetPrototype()) {
-    JSReceiver::cast(current)->LookupOwn(name, result, false);
+  for (PrototypeIterator<STORE_AS_POINTER, MAP_BASED_WALK, END_AT_NULL_VALUE>
+           iter(this); !iter.IsAtEnd(); iter.Advance()) {
+    JSReceiver::cast(iter.GetCurrent())->LookupOwn(name, result, false);
     if (result->IsFound()) return;
   }
   result->NotFound();
@@ -6292,11 +6284,10 @@ MaybeHandle<FixedArray> JSReceiver::GetKeys(Handle<JSReceiver> object,
       isolate);
 
   // Only collect keys if access is permitted.
-  for (Handle<Object> p = object;
-       *p != isolate->heap()->null_value();
-       p = Handle<Object>(p->GetPrototype(isolate), isolate)) {
-    if (p->IsJSProxy()) {
-      Handle<JSProxy> proxy(JSProxy::cast(*p), isolate);
+  for (PrototypeIterator<STORE_AS_HANDLE, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(isolate, object); !iter.IsAtEnd(); iter.Advance()) {
+    if (iter.GetCurrent()->IsJSProxy()) {
+      Handle<JSProxy> proxy(JSProxy::cast(*iter.GetCurrent()), isolate);
       Handle<Object> args[] = { proxy };
       Handle<Object> names;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -6315,7 +6306,7 @@ MaybeHandle<FixedArray> JSReceiver::GetKeys(Handle<JSReceiver> object,
       break;
     }
 
-    Handle<JSObject> current(JSObject::cast(*p), isolate);
+    Handle<JSObject> current(JSObject::cast(*iter.GetCurrent()), isolate);
 
     // Check access rights if required.
     if (current->IsAccessCheckNeeded() &&
@@ -6533,22 +6524,20 @@ void JSObject::DefinePropertyAccessor(Handle<JSObject> object,
 
 
 bool Map::DictionaryElementsInPrototypeChainOnly() {
-  Heap* heap = GetHeap();
-
   if (IsDictionaryElementsKind(elements_kind())) {
     return false;
   }
 
-  for (Object* prototype = this->prototype();
-       prototype != heap->null_value();
-       prototype = prototype->GetPrototype(GetIsolate())) {
-    if (prototype->IsJSProxy()) {
+  for (PrototypeIterator<STORE_AS_POINTER, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(GetIsolate(), this->prototype()); !iter.IsAtEnd();
+       iter.Advance()) {
+    if (iter.GetCurrent()->IsJSProxy()) {
       // Be conservative, don't walk into proxies.
       return true;
     }
 
     if (IsDictionaryElementsKind(
-            JSObject::cast(prototype)->map()->elements_kind())) {
+            JSObject::cast(iter.GetCurrent())->map()->elements_kind())) {
       return true;
     }
   }
@@ -6638,7 +6627,7 @@ void JSObject::DefineAccessor(Handle<JSObject> object,
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return;
     ASSERT(proto->IsJSGlobalObject());
     DefineAccessor(Handle<JSObject>::cast(proto),
@@ -6814,7 +6803,7 @@ MaybeHandle<Object> JSObject::SetAccessor(Handle<JSObject> object,
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return object;
     ASSERT(proto->IsJSGlobalObject());
     return SetAccessor(Handle<JSObject>::cast(proto), info);
@@ -6898,11 +6887,11 @@ MaybeHandle<Object> JSObject::GetAccessor(Handle<JSObject> object,
   // Make the lookup and include prototypes.
   uint32_t index = 0;
   if (name->AsArrayIndex(&index)) {
-    for (Handle<Object> obj = object;
-         !obj->IsNull();
-         obj = handle(JSReceiver::cast(*obj)->GetPrototype(), isolate)) {
-      if (obj->IsJSObject() && JSObject::cast(*obj)->HasDictionaryElements()) {
-        JSObject* js_object = JSObject::cast(*obj);
+    for (PrototypeIterator<STORE_AS_HANDLE, MAP_BASED_WALK, END_AT_NULL_VALUE>
+             iter(object); !iter.IsAtEnd(); iter.Advance()) {
+      if (iter.GetCurrent()->IsJSObject() &&
+          JSObject::cast(*iter.GetCurrent())->HasDictionaryElements()) {
+        JSObject* js_object = JSObject::cast(*iter.GetCurrent());
         SeededNumberDictionary* dictionary = js_object->element_dictionary();
         int entry = dictionary->FindEntry(index);
         if (entry != SeededNumberDictionary::kNotFound) {
@@ -6916,17 +6905,16 @@ MaybeHandle<Object> JSObject::GetAccessor(Handle<JSObject> object,
       }
     }
   } else {
-    for (Handle<Object> obj = object;
-         !obj->IsNull();
-         obj = handle(JSReceiver::cast(*obj)->GetPrototype(), isolate)) {
+    for (PrototypeIterator<STORE_AS_HANDLE, MAP_BASED_WALK, END_AT_NULL_VALUE>
+             iter(object); !iter.IsAtEnd(); iter.Advance()) {
       LookupResult result(isolate);
-      JSReceiver::cast(*obj)->LookupOwn(name, &result);
+      JSReceiver::cast(*iter.GetCurrent())->LookupOwn(name, &result);
       if (result.IsFound()) {
         if (result.IsReadOnly()) return isolate->factory()->undefined_value();
         if (result.IsPropertyCallbacks()) {
-          Object* obj = result.GetCallbackObject();
-          if (obj->IsAccessorPair()) {
-            return handle(AccessorPair::cast(obj)->GetComponent(component),
+          Object* callback = result.GetCallbackObject();
+          if (callback->IsAccessorPair()) {
+            return handle(AccessorPair::cast(callback)->GetComponent(component),
                           isolate);
           }
         }
@@ -10060,9 +10048,10 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
   Handle<Object> prototype;
   if (function->has_instance_prototype()) {
     prototype = handle(function->instance_prototype(), isolate);
-    for (Handle<Object> p = prototype; !p->IsNull() && !p->IsJSProxy();
-         p = Object::GetPrototype(isolate, p)) {
-      JSObject::OptimizeAsPrototype(Handle<JSObject>::cast(p));
+    for (PrototypeIterator<STORE_AS_HANDLE, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+             iter(isolate, prototype);
+         !iter.IsAtEnd() && !iter.GetCurrent()->IsJSProxy(); iter.Advance()) {
+      JSObject::OptimizeAsPrototype(Handle<JSObject>::cast(iter.GetCurrent()));
     }
   } else {
     prototype = isolate->factory()->NewFunctionPrototype(function);
@@ -12134,10 +12123,9 @@ MaybeHandle<Object> JSObject::SetPrototype(Handle<JSObject> object,
   // prototype cycles are prevented.
   // It is sufficient to validate that the receiver is not in the new prototype
   // chain.
-  for (Object* pt = *value;
-       pt != heap->null_value();
-       pt = pt->GetPrototype(isolate)) {
-    if (JSReceiver::cast(pt) == *object) {
+  for (PrototypeIterator<STORE_AS_POINTER, TYPE_BASED_WALK, END_AT_NULL_VALUE>
+           iter(isolate, *value); !iter.IsAtEnd(); iter.Advance()) {
+    if (JSReceiver::cast(iter.GetCurrent()) == *object) {
       // Cycle detected.
       Handle<Object> error = isolate->factory()->NewError(
           "cyclic_proto", HandleVector<Object>(NULL, 0));
@@ -12152,11 +12140,9 @@ MaybeHandle<Object> JSObject::SetPrototype(Handle<JSObject> object,
   if (skip_hidden_prototypes) {
     // Find the first object in the chain whose prototype object is not
     // hidden and set the new prototype on that object.
-    Object* current_proto = real_receiver->GetPrototype();
-    while (current_proto->IsJSObject() &&
-          JSObject::cast(current_proto)->map()->is_hidden_prototype()) {
-      real_receiver = handle(JSObject::cast(current_proto), isolate);
-      current_proto = current_proto->GetPrototype(isolate);
+    for (PrototypeIterator<STORE_AS_POINTER, TYPE_BASED_WALK, END_AT_NON_HIDDEN>
+             iter(isolate, *real_receiver); !iter.IsAtEnd(); iter.Advance()) {
+      real_receiver = handle(JSObject::cast(iter.GetCurrent()), isolate);
     }
   }
 
@@ -12205,7 +12191,8 @@ MaybeHandle<AccessorPair> JSObject::GetOwnElementAccessorPair(
     Handle<JSObject> object,
     uint32_t index) {
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), object->GetIsolate());
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object),
+                         object->GetIsolate());
     if (proto->IsNull()) return MaybeHandle<AccessorPair>();
     ASSERT(proto->IsJSGlobalObject());
     return GetOwnElementAccessorPair(Handle<JSObject>::cast(proto), index);
@@ -12810,7 +12797,7 @@ MaybeHandle<Object> JSObject::SetElement(Handle<JSObject> object,
   }
 
   if (object->IsJSGlobalProxy()) {
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return value;
     ASSERT(proto->IsJSGlobalObject());
     return SetElement(Handle<JSObject>::cast(proto), index, value, attributes,
@@ -13314,7 +13301,7 @@ MaybeHandle<Object> JSObject::GetElementWithInterceptor(
       Object);
   if (!result->IsTheHole()) return result;
 
-  Handle<Object> proto(object->GetPrototype(), isolate);
+  Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
   if (proto->IsNull()) return isolate->factory()->undefined_value();
   return Object::GetElementWithReceiver(isolate, proto, receiver, index);
 }
@@ -13679,7 +13666,7 @@ bool JSObject::HasRealElementProperty(Handle<JSObject> object, uint32_t index) {
 
   if (object->IsJSGlobalProxy()) {
     HandleScope scope(isolate);
-    Handle<Object> proto(object->GetPrototype(), isolate);
+    Handle<Object> proto(SAFE_GET_PROTOTYPE_FAST(*object), isolate);
     if (proto->IsNull()) return false;
     ASSERT(proto->IsJSGlobalObject());
     return HasRealElementProperty(Handle<JSObject>::cast(proto), index);