Do not call setters of read-only accessors.

BUG=
TEST=mjsunit/readonly-accessor
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/271433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -3147,10 +3147,13 @@ MaybeHandle<Object> JSObject::SetPropertyViaPrototypes(
       }
       case CALLBACKS: {
         *done = true;
+        if (!result.IsReadOnly()) {
           Handle<Object> callback_object(result.GetCallbackObject(), isolate);
           return SetPropertyWithCallback(object, callback_object, name, value,
                                          handle(result.holder()), strict_mode);
         }
+        break;
+      }
       case HANDLER: {
         Handle<JSProxy> proxy(result.proxy());
         return JSProxy::SetPropertyViaPrototypesWithHandler(

test/mjsunit/readonly-accessor.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var foo = {};
+foo.__proto__ = new String("bar");
+foo.length = 20;