Fix PropertyDescriptor::ToObject

When adding properties to the result object, that object's prototype chain should be ignored.

Review URL: https://codereview.chromium.org/1458873002

Cr-Commit-Position: refs/heads/master@{#32085}

src/property-descriptor.cc

@@ -103,7 +103,7 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<Object> obj,
 
 static void CreateDataProperty(Isolate* isolate, Handle<JSObject> object,
                                Handle<String> name, Handle<Object> value) {
-  LookupIterator it(object, name);
+  LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<bool> result = JSObject::CreateDataProperty(&it, value);
   CHECK(result.IsJust() && result.FromJust());
 }

test/mjsunit/regress/property-descriptor-to-object.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { prop: 1 };
+Object.prototype.value = 0;
+var d = Object.getOwnPropertyDescriptor(o, "prop");
+assertEquals(1, d.value);