[ic] Don't enable property cell mode for a LoadGlobalIC if the holder is a...

[ic] Don't enable property cell mode for a LoadGlobalIC if the holder is a different global object than the receiver.

Test contributed by crlf0710 <crlf0710@gmail.com>.

BUG=v8:5552

Review-Url: https://codereview.chromium.org/2523173002
Cr-Commit-Position: refs/heads/master@{#41213}

src/ic/ic.cc

@@ -1085,12 +1085,8 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
   } else {
     if (kind() == Code::LOAD_GLOBAL_IC &&
         lookup->state() == LookupIterator::DATA &&
-        lookup->GetHolder<Object>()->IsJSGlobalObject()) {
-#if DEBUG
-      Handle<Object> holder = lookup->GetHolder<Object>();
-      Handle<Object> receiver = lookup->GetReceiver();
-      DCHECK_EQ(*receiver, *holder);
-#endif
+        lookup->GetReceiver().is_identical_to(lookup->GetHolder<Object>())) {
+      DCHECK(lookup->GetReceiver()->IsJSGlobalObject());
       // Now update the cell in the feedback vector.
       LoadGlobalICNexus* nexus = casted_nexus<LoadGlobalICNexus>();
       nexus->ConfigurePropertyCellMode(lookup->GetPropertyCell());

test/cctest/test-global-object.cc

@@ -105,3 +105,30 @@ TEST(KeysGlobalObject_Regress2764) {
       Local<Array>::Cast(CompileRun("Object.getOwnPropertyNames(global2)"));
   CHECK_EQ(0u, result->Length());
 }
+
+TEST(KeysGlobalObject_SetPrototype) {
+  LocalContext env1;
+  v8::HandleScope scope(env1->GetIsolate());
+
+  // Create second environment.
+  v8::Local<Context> env2 = Context::New(env1->GetIsolate());
+
+  Local<Value> token = v8_str("foo");
+
+  // Set same security token for env1 and env2.
+  env1->SetSecurityToken(token);
+  env2->SetSecurityToken(token);
+
+  // Create a reference to env2 global from env1 global.
+  env1->Global()
+      ->GetPrototype()
+      .As<v8::Object>()
+      ->SetPrototype(env1.local(), env2->Global()->GetPrototype())
+      .FromJust();
+  // Set some global variables in global2
+  env2->Global()->Set(env2, v8_str("a"), v8_str("a")).FromJust();
+  env2->Global()->Set(env2, v8_str("42"), v8_str("42")).FromJust();
+
+  // List all entries from global2.
+  ExpectTrue("a == 'a'");
+}