Expect requiring access check on objects with hidden properties.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/563723002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -4714,12 +4714,8 @@ Object* JSObject::GetHiddenPropertiesHashTable() {
     Isolate* isolate = GetIsolate();
     LookupIterator it(handle(this), isolate->factory()->hidden_string(),
                       LookupIterator::OWN_SKIP_INTERCEPTOR);
-    CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
-    if (it.state() == LookupIterator::DATA) {
-      return *it.GetDataValue();
-    }
-    DCHECK(!it.IsFound());
-    return GetHeap()->undefined_value();
+    // Access check is always skipped for the hidden string anyways.
+    return *GetDataProperty(&it);
   }
 }
 

test/cctest/test-api.cc

@@ -23016,3 +23016,22 @@ TEST(Regress411877) {
   context->Global()->Set(v8_str("o"), object_template->NewInstance());
   CompileRun("Object.getOwnPropertyNames(o)");
 }
+
+
+TEST(GetHiddenPropertyTableAfterAccessCheck) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope handle_scope(isolate);
+  v8::Handle<v8::ObjectTemplate> object_template =
+      v8::ObjectTemplate::New(isolate);
+  object_template->SetAccessCheckCallbacks(NamedAccessCounter,
+                                           IndexedAccessCounter);
+
+  v8::Handle<Context> context = Context::New(isolate);
+  v8::Context::Scope context_scope(context);
+
+  v8::Handle<v8::Object> obj = object_template->NewInstance();
+  obj->Set(v8_str("key"), v8_str("value"));
+  obj->Delete(v8_str("key"));
+
+  obj->SetHiddenValue(v8_str("hidden key 2"), v8_str("hidden value 2"));
+}