Make sure that post-interceptor property getter doesn't assume name lookup is...

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 3836)
+++ src/objects.cc	(working copy)
@@ -6170,7 +6170,13 @@
   // Check local property in holder, ignore interceptor.
   LookupResult result;
   LocalLookupRealNamedProperty(name, &result);
-  if (result.IsValid()) return GetProperty(receiver, &result, name, attributes);
+  if (result.IsValid()) {
+    Object* p = GetProperty(receiver, &result, name, attributes);
+    // Successful name lookup doesn't mean the value is there, because the

[Mads Ager (chromium), 2010/02/18 08:29:30]

There is something fishy going on here.  The result.IsValid() check should make
sure that there actually is a property on the object.

+    // name could've been introduced by the interceptor. Only return property
+    // if it's not absent.
+    if (*attributes != ABSENT) return p;
+  }
   // Continue searching via the prototype chain.
   Object* pt = GetPrototype();
   *attributes = ABSENT;