Implement loads and calls from 'super'

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index 3b11ebce798c56fa04ffc11b568348f75f727412..1cbcd358f1eccd4e39fc64276b53e2d94200a0f3 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -270,6 +270,38 @@ bool LookupIterator::HolderIsReceiverOrHiddenPrototype() const {
 }
 
 
+void LookupIterator::LookupForRead() {
+  for (; IsFound(); Next()) {
+    switch (state()) {
+      case LookupIterator::NOT_FOUND:
+      case LookupIterator::TRANSITION:
+        UNREACHABLE();
+      case LookupIterator::JSPROXY:
+        return;
+      case LookupIterator::INTERCEPTOR: {
+        // If there is a getter, return; otherwise loop to perform the lookup.
+        Handle<JSObject> holder = GetHolder<JSObject>();
+        if (!holder->GetNamedInterceptor()->getter()->IsUndefined()) {
+          return;
+        }
+        break;
+      }
+      case LookupIterator::ACCESS_CHECK:
+        // PropertyHandlerCompiler::CheckPrototypes() knows how to emit
+        // access checks for global proxies.
+        if (GetHolder<JSObject>()->IsJSGlobalProxy() &&

[Toon Verwaest, 2014/09/15 11:57:20]

Wth? Why do you explicitly avoid access checks on everything that's not a
JSGlobalProxy? Sounds like a security issue right there. E.g.:

o = {f:function() { return super.hasOwnProperty.constructor; }};
o.f[home_object] = otherwindow.location;
otherwindow_Function = o.f();

[Dmitry Lomov (no reviews), 2014/09/15 12:31:12]

As discussed offline, this returns otherwise, so doesn't really avoid access
checks (it is also just a copy from ic.cc), but it looks like I do not need this
anyway

+            HasAccess(v8::ACCESS_GET)) {
+          break;
+        }
+        return;
+      case LookupIterator::PROPERTY:
+        if (HasProperty()) return;  // Yay!
+        break;
+    }
+  }
+}
+
+
 Handle<Object> LookupIterator::FetchValue() const {
   Object* result = NULL;
   Handle<JSObject> holder = GetHolder<JSObject>();