Expect requiring access check on objects with hidden properties.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 31fa7e4e61d13977ad0bf87ed407dbcaef22cfa4..4459a5b05cafabe7e0dae338d501e358e3ffedf2 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4714,12 +4714,8 @@ Object* JSObject::GetHiddenPropertiesHashTable() {
     Isolate* isolate = GetIsolate();
     LookupIterator it(handle(this), isolate->factory()->hidden_string(),
                       LookupIterator::OWN_SKIP_INTERCEPTOR);
-    CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
-    if (it.state() == LookupIterator::DATA) {
-      return *it.GetDataValue();
-    }
-    DCHECK(!it.IsFound());
-    return GetHeap()->undefined_value();
+    // Access check is always skipped for the hidden string anyways.
+    return *GetDataProperty(&it);
   }
 }