Expect access check in JSObject::DefineAccessor.

R=ulan@chromium.org, verwaest@chromium.org
BUG=chromium:411793
LOG=N

Review URL: https://codereview.chromium.org/559403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23874 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -6147,7 +6147,10 @@ MaybeHandle<Object> JSObject::DefineAccessor(Handle<JSObject> object,
     // At least one of the accessors needs to be a new value.
     DCHECK(!getter->IsNull() || !setter->IsNull());
     LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
-    CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
+    if (it.state() == LookupIterator::ACCESS_CHECK) {
+      // We already did an access check before. We do have access.
+      it.Next();
+    }
     if (!getter->IsNull()) {
       it.TransitionToAccessorProperty(ACCESSOR_GETTER, getter, attributes);
     }

test/cctest/test-api.cc

@@ -23035,3 +23035,21 @@ TEST(GetHiddenPropertyTableAfterAccessCheck) {
 
   obj->SetHiddenValue(v8_str("hidden key 2"), v8_str("hidden value 2"));
 }
+
+
+TEST(Regress411793) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope handle_scope(isolate);
+  v8::Handle<v8::ObjectTemplate> object_template =
+      v8::ObjectTemplate::New(isolate);
+  object_template->SetAccessCheckCallbacks(NamedAccessCounter,
+                                           IndexedAccessCounter);
+
+  v8::Handle<Context> context = Context::New(isolate);
+  v8::Context::Scope context_scope(context);
+
+  context->Global()->Set(v8_str("o"), object_template->NewInstance());
+  CompileRun(
+      "Object.defineProperty(o, 'key', "
+      "    { get: function() {}, set: function() {} });");
+}