Fix access check in JSObject::PreventExtensions.

BUG=

Review URL: https://codereview.chromium.org/1422973002

Cr-Commit-Position: refs/heads/master@{#31573}

src/objects.cc

@@ -6771,8 +6771,6 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
                                         ShouldThrow should_throw) {
   Isolate* isolate = object->GetIsolate();
 
-  if (!object->map()->is_extensible()) return Just(true);
-
   if (!object->HasSloppyArgumentsElements() && !object->map()->is_observed()) {
     return PreventExtensionsWithTransition<NONE>(object, should_throw);
   }
@@ -6786,6 +6784,8 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
                    NewTypeError(MessageTemplate::kNoAccess));
   }
 
+  if (!object->map()->is_extensible()) return Just(true);
+
   if (object->IsJSGlobalProxy()) {
     PrototypeIterator iter(isolate, object);
     if (iter.IsAtEnd()) return Just(true);
@@ -6883,6 +6883,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
                    NewTypeError(MessageTemplate::kNoAccess));
   }
 
+  if (attrs == NONE && !object->map()->is_extensible()) return Just(true);
+
   if (object->IsJSGlobalProxy()) {
     PrototypeIterator iter(isolate, object);
     if (iter.IsAtEnd()) return Just(true);

test/cctest/test-api.cc

@@ -8660,6 +8660,15 @@ TEST(AccessControl) {
       "})()");
   CHECK(value->IsTrue());
 
+  // Test that preventExtensions fails on a non-accessible object even if that
+  // object is already non-extensible.
+  global1->Set(v8_str("checked_object"), global_template->NewInstance());
+  allowed_access = true;
+  CompileRun("Object.preventExtensions(checked_object)");
+  ExpectFalse("Object.isExtensible(checked_object)");
+  allowed_access = false;
+  CHECK(CompileRun("Object.preventExtensions(checked_object)").IsEmpty());
+
   context1->Exit();
   context0->Exit();
 }