Make sure we always try to make prototypes fast again when transitioning accessors

BUG=chromium:605060
LOG=n

Review URL: https://codereview.chromium.org/1907953002

Cr-Commit-Position: refs/heads/master@{#35697}

src/lookup.cc

@@ -414,7 +414,10 @@ void LookupIterator::TransitionToAccessorProperty(
     pair = Handle<AccessorPair>::cast(GetAccessors());
     // If the component and attributes are identical, nothing has to be done.
     if (pair->get(component) == *accessor) {
-      if (property_details().attributes() == attributes) return;
+      if (property_details().attributes() == attributes) {
+        if (!IsElement()) JSObject::ReoptimizeIfPrototype(receiver);
+        return;
+      }
     } else {
       pair = AccessorPair::Copy(pair);
       pair->set(component, *accessor);

test/mjsunit/regress/regress-crbug-605060.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+assertTrue(%HasFastProperties(Array.prototype));