From c153a8437e2d4f579f65485d7fc9f2f751010624 Mon Sep 17 00:00:00 2001
From: verwaest <verwaest@chromium.org>
Date: Fri, 17 Apr 2015 02:25:27 -0700
Subject: [PATCH] [crankshaft] Fix property access with proxies in prototype
 chain

BUG=

Review URL: https://codereview.chromium.org/1090813003

Cr-Commit-Position: refs/heads/master@{#27911}
---
 src/hydrogen.cc                 |  3 ++-
 test/mjsunit/harmony/proxies.js | 23 +++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 46f0bfe..03bd971 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6114,8 +6114,9 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
     LookupDescriptor(*map, *name_);
     if (IsFound()) return LoadResult(map);
   }
+
   NotFound();
-  return true;
+  return !map->prototype()->IsJSReceiver();
 }
 
 
diff --git a/test/mjsunit/harmony/proxies.js b/test/mjsunit/harmony/proxies.js
index 2b0ec76..2500ecc 100644
--- a/test/mjsunit/harmony/proxies.js
+++ b/test/mjsunit/harmony/proxies.js
@@ -30,6 +30,7 @@
 // overflow the system stack before the simulator stack.
 
 // Flags: --harmony-proxies --sim-stack-size=500 --turbo-deoptimization
+// Flags: --allow-natives-syntax
 
 
 // Helper.
@@ -2302,3 +2303,25 @@ function TestConstructorWithProxyPrototype2(create, handler) {
 }
 
 TestConstructorWithProxyPrototype();
+
+function TestOptWithProxyPrototype() {
+  var handler = {
+    getPropertyDescriptor: function(k) {
+      return {value: 10, configurable: true, enumerable: true, writable: true};
+    }
+  };
+
+  function C() {};
+  C.prototype = Proxy.create(handler);
+  var o = new C();
+
+  function f() {
+    return o.x;
+  }
+  assertEquals(10, f());
+  assertEquals(10, f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(10, f());
+}
+
+TestOptWithProxyPrototype();
-- 
2.7.4