Merge bleeding_edge revision 6786 to trunk.
Review URL: http://codereview.chromium.org/6523022
git-svn-id: http://v8.googlecode.com/svn/trunk@6790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/runtime.cc b/src/runtime.cc
index ef7a4ac..4e7a31c 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4214,6 +4214,14 @@
Handle<JSObject> object(raw_object);
if (object->IsJSGlobalProxy()) {
+ // Do access checks before going to the global object.
+ if (object->IsAccessCheckNeeded() &&
+ !Top::MayNamedAccess(*object, Heap::undefined_value(),
+ v8::ACCESS_KEYS)) {
+ Top::ReportFailedAccessCheck(*object, v8::ACCESS_KEYS);
+ return *Factory::NewJSArray(0);
+ }
+
Handle<Object> proto(object->GetPrototype());
// If proxy is detached we simply return an empty array.
if (proto->IsNull()) return *Factory::NewJSArray(0);