Bailout from crankshaft if a global property is found in the prototype chain of the global object, not on the global object itself.

Review URL: http://codereview.chromium.org/6449002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -2952,6 +2952,9 @@ void HGraphBuilder::LookupGlobalPropertyCell(Variable* var,
   if (is_store && lookup->IsReadOnly()) {
     BAILOUT("read-only global variable");
   }
+  if (lookup->holder() != *global) {
+    BAILOUT("global property on prototype of global object");
+  }
 }