[ic] Set JSGlobalObject to the default holder for LoadGlobal

BUG=v8:5561

Change-Id: I3f8bac0083e22066ee26f4bfeae5a16f81654a91
Reviewed-on: https://chromium-review.googlesource.com/458424Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44060}

src/ic/accessor-assembler.cc

@@ -451,12 +451,8 @@ void AccessorAssembler::HandleLoadICProtoHandlerCase(
   {
     Label load_from_cached_holder(this), done(this);
 
-    GotoIf(WordNotEqual(maybe_holder_cell, NullConstant()),
+    Branch(WordEqual(maybe_holder_cell, NullConstant()), &done,
            &load_from_cached_holder);
-    {
-      var_holder->Bind(p->receiver);
-      Goto(&done);
-    }
 
     Bind(&load_from_cached_holder);
     {
@@ -553,7 +549,9 @@ void AccessorAssembler::HandleLoadGlobalICHandlerCase(
   Node* native_context = LoadNativeContext(p.context);
   p.receiver = LoadContextElement(native_context, Context::GLOBAL_PROXY_INDEX);
 
-  Variable var_holder(this, MachineRepresentation::kTagged);
+  Variable var_holder(
+      this, MachineRepresentation::kTagged,
+      LoadContextElement(native_context, Context::EXTENSION_INDEX));
   Variable var_smi_handler(this, MachineRepresentation::kTagged);
   Label if_smi_handler(this);
 

src/ic/ic.cc

@@ -1169,7 +1169,7 @@ Handle<Object> LoadIC::GetMapIndependentHandler(LookupIterator* lookup) {
         return LoadFullChain(map, holder_ref, lookup->name(), smi_handler);
       }
 
-      if (receiver_is_holder && !IsLoadGlobalIC()) {
+      if (receiver_is_holder) {
         DCHECK(map->has_named_interceptor());
         TRACE_HANDLER_STATS(isolate(), LoadIC_LoadInterceptorDH);
         return smi_handler;