[ic] Properly handle reconfiguring of a global property to 'readonly'.

Bug: chromium:722783
Change-Id: Id4612f3d45fb26daca8b4ef2efb0f7bc9ac39ed3
Reviewed-on: https://chromium-review.googlesource.com/579268Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46795}

src/objects.cc

@@ -19500,7 +19500,8 @@ Handle<PropertyCell> PropertyCell::PrepareForValue(
   const PropertyDetails original_details = cell->property_details();
   // Data accesses could be cached in ics or optimized code.
   bool invalidate =
-      original_details.kind() == kData && details.kind() == kAccessor;
+      (original_details.kind() == kData && details.kind() == kAccessor) ||
+      (!original_details.IsReadOnly() && details.IsReadOnly());
   int index;
   PropertyCellType old_type = original_details.cell_type();
   // Preserve the enumeration index unless the property was deleted or never

test/mjsunit/regress/regress-crbug-722783.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function set_x(v) {
+  x = v;
+}
+
+var o = {};
+set_x(o);
+set_x(o);
+assertEquals(o, x);
+Object.defineProperty(this, "x", { value:5, writable:false, configurable:true });
+assertEquals(5, x);
+set_x(o);
+set_x(o);
+assertEquals(5, x);
+Object.defineProperty(this, "x", { value:42, writable:true, configurable:true });
+assertEquals(42, x);
+set_x(o);
+assertEquals(o, x);