Check holder before optimizing calls to global functions.

In the case where the function is not found in the global object,
we have to generate a generic call.

BUG=v8:1106
TEST=mjsunit/regress/regress-1106.js

Review URL: http://codereview.chromium.org/6483010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ast.cc

@@ -618,7 +618,9 @@ bool Call::ComputeGlobalTarget(Handle<GlobalObject> global,
   cell_ = Handle<JSGlobalPropertyCell>::null();
   LookupResult lookup;
   global->Lookup(*name, &lookup);
-  if (lookup.IsProperty() && lookup.type() == NORMAL) {
+  if (lookup.IsProperty() &&
+      lookup.type() == NORMAL &&
+      lookup.holder() == *global) {
     cell_ = Handle<JSGlobalPropertyCell>(global->GetPropertyCell(&lookup));
     if (cell_->value()->IsJSFunction()) {
       Handle<JSFunction> candidate(JSFunction::cast(cell_->value()));

test/mjsunit/regress/regress-1106.js

@@ -40,3 +40,11 @@ function f() { return foo; }
 for (i=0 ; i < 100000; ++i) {
   assertEquals(5, f());
 }
+
+// Test calls on functions defined in the prototype of the global object.
+x.gee = function() { return 42; }
+function g() { return gee(); }
+
+for (i=0 ; i < 100000; ++i) {
+  assertEquals(42, g());
+}