Fix a prototype chain traversal not expecting proxies.

R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8144011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index d3cb8b5ee20d52de8193ade6e9e256666d357f2d..b4db9e5605a9212851a4b46cd4fbefadde2d8685 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3995,7 +3995,7 @@ void JSReceiver::Lookup(String* name, LookupResult* result) {
 void JSObject::LookupCallback(String* name, LookupResult* result) {
   Heap* heap = GetHeap();
   for (Object* current = this;
-       current != heap->null_value();
+       current != heap->null_value() && current->IsJSObject();
        current = JSObject::cast(current)->GetPrototype()) {
     JSObject::cast(current)->LocalLookupRealNamedProperty(name, result);
     if (result->IsProperty() && result->type() == CALLBACKS) return;