Add access check to JSObject::IsExtensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1378343002

Cr-Commit-Position: refs/heads/master@{#31055}

src/objects.cc

@@ -4867,7 +4867,8 @@ Maybe<bool> JSObject::CreateDataProperty(LookupIterator* it,
   if (it->IsFound()) {
     if (!it->IsConfigurable()) return Just(false);
   } else {
-    if (!JSObject::cast(*it->GetReceiver())->IsExtensible()) return Just(false);
+    if (!JSObject::IsExtensible(Handle<JSObject>::cast(it->GetReceiver())))
+      return Just(false);
   }
 
   RETURN_ON_EXCEPTION_VALUE(
@@ -6016,14 +6017,18 @@ MaybeHandle<Object> JSObject::PreventExtensions(Handle<JSObject> object) {
 }
 
 
-bool JSObject::IsExtensible() {
-  if (IsJSGlobalProxy()) {
-    PrototypeIterator iter(GetIsolate(), this);
+bool JSObject::IsExtensible(Handle<JSObject> object) {
+  Isolate* isolate = object->GetIsolate();
+  if (object->IsAccessCheckNeeded() && !isolate->MayAccess(object)) {
+    return true;
+  }
+  if (object->IsJSGlobalProxy()) {
+    PrototypeIterator iter(isolate, *object);
     if (iter.IsAtEnd()) return false;
     DCHECK(iter.GetCurrent()->IsJSGlobalObject());
     return iter.GetCurrent<JSObject>()->map()->is_extensible();
   }
-  return map()->is_extensible();
+  return object->map()->is_extensible();
 }
 
 

src/objects.h

@@ -2271,7 +2271,7 @@ class JSObject: public JSReceiver {
   MUST_USE_RESULT static MaybeHandle<Object> PreventExtensions(
       Handle<JSObject> object);
 
-  bool IsExtensible();
+  static bool IsExtensible(Handle<JSObject> object);
 
   // ES5 Object.seal
   MUST_USE_RESULT static MaybeHandle<Object> Seal(Handle<JSObject> object);

src/runtime/runtime-object.cc

@@ -310,10 +310,10 @@ RUNTIME_FUNCTION(Runtime_PreventExtensions) {
 
 
 RUNTIME_FUNCTION(Runtime_IsExtensible) {
-  SealHandleScope shs(isolate);
+  HandleScope scope(isolate);
   DCHECK(args.length() == 1);
-  CONVERT_ARG_CHECKED(JSObject, obj, 0);
-  return isolate->heap()->ToBoolean(obj->IsExtensible());
+  CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
+  return isolate->heap()->ToBoolean(JSObject::IsExtensible(obj));
 }