Get rid of all non-IC uses of LookupOwnRealNamedProperty

src/lookup-inl.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_LOOKUP_INL_H_
 #define V8_LOOKUP_INL_H_
 
 #include "src/lookup.h"
 
 namespace v8 {
 namespace internal {
 
 
 JSReceiver* LookupIterator::NextHolder(Map* map) {
   DisallowHeapAllocation no_gc;
   if (map->prototype()->IsNull()) return NULL;
 
   JSReceiver* next = JSReceiver::cast(map->prototype());
   DCHECK(!next->map()->IsGlobalObjectMap() ||
          next->map()->is_hidden_prototype());
 
   if (!check_derived() &&
-      !(check_hidden() && next->map()->is_hidden_prototype())) {
+      !(check_hidden() && next->map()->is_hidden_prototype()) &&
+      // Always lookup behind the JSGlobalProxy into the JSGlobalObject, even
+      // when not checking other hidden prototypes.
+      !(map->IsJSGlobalProxyMap() && next->IsJSGlobalObject())) {
     return NULL;
   }
 
   return next;
 }
 
 
 LookupIterator::State LookupIterator::LookupInHolder(Map* map) {
   STATIC_ASSERT(INTERCEPTOR == BEFORE_PROPERTY);
   DisallowHeapAllocation no_gc;
@@ skipping 26 matching lines @@
     case JSPROXY:
       UNREACHABLE();
   }
   UNREACHABLE();
   return state_;
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_LOOKUP_INL_H_