diff --git a/src/ic/x87/handler-compiler-x87.cc b/src/ic/x87/handler-compiler-x87.cc index 2eb10c3a3b..f64e7d8f0d 100644 --- a/src/ic/x87/handler-compiler-x87.cc +++ b/src/ic/x87/handler-compiler-x87.cc @@ -431,6 +431,17 @@ Register PropertyHandlerCompiler::CheckPrototypes( if (receiver_map->IsJSGlobalObjectMap()) { current = isolate()->global_object(); } + + // Check access rights to the global object. This has to happen after + // the map check so that we know that the object is actually a global + // object. + // This allows us to install generated handlers for accesses to the + // global proxy (as opposed to using slow ICs). See corresponding code + // in LookupForRead(). + if (receiver_map->IsJSGlobalProxyMap()) { + __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss); + } + Handle prototype = Handle::null(); Handle current_map = receiver_map; Handle holder_map(holder()->map()); @@ -471,17 +482,7 @@ Register PropertyHandlerCompiler::CheckPrototypes( __ j(not_equal, miss); } - // Check access rights to the global object. This has to happen after - // the map check so that we know that the object is actually a global - // object. - // This allows us to install generated handlers for accesses to the - // global proxy (as opposed to using slow ICs). See corresponding code - // in LookupForRead(). - if (current_map->IsJSGlobalProxyMap()) { - __ CheckAccessGlobalProxy(reg, map_reg, scratch2, miss); - // Restore map_reg. - __ mov(map_reg, FieldOperand(reg, HeapObject::kMapOffset)); - } else if (current_map->IsJSGlobalObjectMap()) { + if (current_map->IsJSGlobalObjectMap()) { GenerateCheckPropertyCell(masm(), Handle::cast(current), name, scratch2, miss); } @@ -505,13 +506,6 @@ Register PropertyHandlerCompiler::CheckPrototypes( __ j(not_equal, miss); } - // Perform security check for access to the global object. - DCHECK(current_map->IsJSGlobalProxyMap() || - !current_map->is_access_check_needed()); - if (current_map->IsJSGlobalProxyMap()) { - __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss); - } - // Return the register containing the holder. return reg; }