Fix crash with indexed setter on objects without corresponding getter.

Review URL: http://codereview.chromium.org/63010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

-// Copyright 2006-2008 the V8 project authors. All rights reserved.
+// Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -5521,6 +5521,9 @@ Object* JSObject::GetElementWithReceiver(JSObject* receiver, uint32_t index) {
         if (getter->IsJSFunction()) {
           return GetPropertyWithDefinedGetter(receiver,
                                               JSFunction::cast(getter));
+        } else {
+          // Getter is not a function.
+          return Heap::undefined_value();
         }
       }
       return element;

test/mjsunit/indexed-accessors.js

@@ -98,3 +98,23 @@ assertEquals(6, a.length);
 var q = {};
 q.__defineGetter__('0', function() { return 42; });
 assertThrows('q[0] = 7');
+
+// Using a getter where only a setter is defined returns undefined.
+var q1 = {};
+q1.__defineSetter__('0', function() {q1.b = 17;});
+assertEquals(q1[0], undefined);
+// Setter works
+q1[0] = 3;
+assertEquals(q1[0], undefined);
+assertEquals(q1.b, 17);
+
+// Complex case of using an undefined getter.
+// From http://code.google.com/p/v8/issues/detail?id=298
+// Reported by nth10sd.
+
+a = function() {};
+__defineSetter__("0", function() {});
+if (a |= '') {};
+assertThrows('this[a].__parent__');
+assertEquals(a, 0);
+assertEquals(this[a], undefined);