Fixed DCHECK in StoreIC::CompileHandler().

BUG=chromium:489597
LOG=N

Review URL: https://codereview.chromium.org/1123153005

Cr-Commit-Position: refs/heads/master@{#28518}

src/ic/ic.cc

@@ -1625,7 +1625,8 @@ Handle<Code> StoreIC::CompileHandler(LookupIterator* lookup,
   // This is currently guaranteed by checks in StoreIC::Store.
   Handle<JSObject> receiver = Handle<JSObject>::cast(lookup->GetReceiver());
   Handle<JSObject> holder = lookup->GetHolder<JSObject>();
-  DCHECK(!receiver->IsAccessCheckNeeded());
+  DCHECK(!receiver->IsAccessCheckNeeded() ||
+         isolate()->IsInternallyUsedPropertyName(lookup->name()));
 
   switch (lookup->state()) {
     case LookupIterator::TRANSITION: {

test/mjsunit/regress/regress-crbug-489597.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  load("test/mjsunit/regress/regress-crbug-489597.js-script");
+} catch (e) {
+}
+
+var o = this;
+Error.captureStackTrace(o);
+o.stack;

test/mjsunit/regress/regress-crbug-489597.js-script

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+throw new Error("boom");