Allocate getters and setters in old space to avoid failing assertion in TransformToFastProperties.

Review URL: http://codereview.chromium.org/39344

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1457 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -2532,7 +2532,7 @@ Object* JSObject::DefineGetterSetter(String* name,
   if (ok->IsFailure()) return ok;
 
   // Allocate the fixed array to hold getter and setter.
-  Object* array = Heap::AllocateFixedArray(2);
+  Object* array = Heap::AllocateFixedArray(2, TENURED);
   if (array->IsFailure()) return array;
 
   // Update the dictionary with the new CALLBACKS property.

test/mjsunit/top-level-assignments.js

@@ -94,3 +94,14 @@ assertEquals(30, calc.sum());
 assertEquals(10, calc.difference());
 assertEquals(200, calc.product());
 assertEquals(2, calc.quotient());
+
+var x = new Object();
+x.__defineGetter__('a', function() { return 7 });
+x.b = function() { return 42; };
+x.c = 88;
+x.d = "A Man Called Horse";
+
+assertEquals(7, x.a);
+assertEquals(42, x.b());
+assertEquals(88, x.c);
+assertEquals("A Man Called Horse", x.d);