commit 6500178338c947ac2fbfaa247656a2c09aaa5f59
author ricow@chromium.org <ricow@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> Tue Feb 15 13:36:41 2011 +0000
committer ricow@chromium.org <ricow@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> Tue Feb 15 13:36:41 2011 +0000
tree b05f8964fe393534560124e33571ba8e3b08b199
parent 496c03a64f12710e837204e261ef155601247895

Merge bleeding_edge revision 6786 to trunk.

Review URL: http://codereview.chromium.org/6523022

git-svn-id: http://v8.googlecode.com/svn/trunk@6790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

diff --git a/src/runtime.cc b/src/runtime.cc
index ef7a4ac..4e7a31c 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4214,6 +4214,14 @@
   Handle<JSObject> object(raw_object);
 
   if (object->IsJSGlobalProxy()) {
+    // Do access checks before going to the global object.
+    if (object->IsAccessCheckNeeded() &&
+        !Top::MayNamedAccess(*object, Heap::undefined_value(),
+                             v8::ACCESS_KEYS)) {
+      Top::ReportFailedAccessCheck(*object, v8::ACCESS_KEYS);
+      return *Factory::NewJSArray(0);
+    }
+
     Handle<Object> proto(object->GetPrototype());
     // If proxy is detached we simply return an empty array.
     if (proto->IsNull()) return *Factory::NewJSArray(0);