Use correct receiver for DOM accessors on the prototype chain

BUG=v8:3538
LOG=y
R=haraken@chromium.org

Review URL: https://codereview.chromium.org/528913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/api.cc

@@ -3610,7 +3610,8 @@ Local<Value> v8::Object::GetRealNamedPropertyInPrototypeChain(
   i::Handle<i::String> key_obj = Utils::OpenHandle(*key);
   i::PrototypeIterator iter(isolate, self_obj);
   if (iter.IsAtEnd()) return Local<Value>();
-  i::LookupIterator it(i::PrototypeIterator::GetCurrent(iter), key_obj,
+  i::Handle<i::Object> proto = i::PrototypeIterator::GetCurrent(iter);
+  i::LookupIterator it(self_obj, key_obj, i::Handle<i::JSReceiver>::cast(proto),
                        i::LookupIterator::PROTOTYPE_CHAIN_PROPERTY);
   return GetPropertyByLookup(&it);
 }