Revert of Invalidate the global property cell when converting from data to...

Revert of Invalidate the global property cell when converting from data to accessor. (patchset #1 id:1 of https://codereview.chromium.org/961003002/)

Reason for revert:
Breaks gc stress, e.g.: http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%201/builds/2322

Original issue's description:
> Invalidate the global property cell when converting from data to accessor.
>
> BUG=
> TBR=jkummerow@chromium.org,
>
> Committed: https://crrev.com/6a12dc240b1faffa500ff269077d832ecc74239d
> Cr-Commit-Position: refs/heads/master@{#26896}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/958113004

Cr-Commit-Position: refs/heads/master@{#26899}

src/ic/handler-compiler.h

@@ -95,7 +95,7 @@ class PropertyHandlerCompiler : public PropertyAccessCompiler {
   Register CheckPrototypes(Register object_reg, Register holder_reg,
                            Register scratch1, Register scratch2,
                            Handle<Name> name, Label* miss,
-                           PrototypeCheckType check);
+                           PrototypeCheckType check = CHECK_ALL_MAPS);
 
   Handle<Code> GetCode(Code::Kind kind, Code::StubType type, Handle<Name> name);
   void set_holder(Handle<JSObject> holder) { holder_ = holder; }

src/objects.cc

@@ -565,15 +565,7 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
   if (object->IsGlobalObject()) {
     Handle<PropertyCell> cell(
         PropertyCell::cast(property_dictionary->ValueAt(entry)));
-    if (details.type() != property_dictionary->DetailsAt(entry).type()) {
-      Isolate* isolate = object->GetIsolate();
-      Handle<Object> hole = isolate->factory()->the_hole_value();
-      PropertyCell::SetValueInferType(cell, hole);
-      cell = isolate->factory()->NewPropertyCell(value);
-      property_dictionary->SetEntry(entry, name, cell, details);
-    } else {
     PropertyCell::SetValueInferType(cell, value);
-    }
     // Please note we have to update the property details.
     property_dictionary->DetailsAtPut(entry, details);
   } else {
@@ -7440,7 +7432,12 @@ Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
   Isolate* isolate = name->GetIsolate();
 
   // Dictionary maps can always have additional data properties.
-  if (map->is_dictionary_map()) return map;
+  if (map->is_dictionary_map()) {
+    // For global objects, property cells are inlined. We need to change the
+    // map.
+    if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
+    return map;
+  }
 
   // Migrate to the newest map before transitioning to the new property.
   map = Update(map);

test/mjsunit/regress/convert-global-data-to-accessor.js

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-function f(o) {
-  return o.x;
-}
-this.x = 100;
-f(this);
-f(this);
-f(this);
-
-Object.defineProperty(this, 'x', { get: function() { return 10; }});
-assertEquals(10, this.x);
-assertEquals(10, f(this));