Fix accessor map transitions vs. Object.defineProperty

BUG=v8:4534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413723011

Cr-Commit-Position: refs/heads/master@{#31750}

src/objects.cc

@@ -6141,11 +6141,11 @@ bool JSReceiver::OrdinaryDefineOwnProperty(LookupIterator* it,
         Handle<Object> getter(
             desc->has_get()
                 ? desc->get()
-                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+                : Handle<Object>::cast(isolate->factory()->null_value()));
         Handle<Object> setter(
             desc->has_set()
                 ? desc->set()
-                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+                : Handle<Object>::cast(isolate->factory()->null_value()));
         MaybeHandle<Object> result =
             JSObject::DefineAccessor(it, getter, setter, desc->ToAttributes());
         if (result.is_null()) return false;
@@ -6338,15 +6338,15 @@ bool JSReceiver::OrdinaryDefineOwnProperty(LookupIterator* it,
       Handle<Object> getter(
           desc->has_get()
               ? desc->get()
-              : current.has_get() ? current.get()
-                                  : Handle<Object>::cast(
-                                        isolate->factory()->undefined_value()));
+              : current.has_get()
+                    ? current.get()
+                    : Handle<Object>::cast(isolate->factory()->null_value()));
       Handle<Object> setter(
           desc->has_set()
               ? desc->set()
-              : current.has_set() ? current.set()
-                                  : Handle<Object>::cast(
-                                        isolate->factory()->undefined_value()));
+              : current.has_set()
+                    ? current.set()
+                    : Handle<Object>::cast(isolate->factory()->null_value()));
       MaybeHandle<Object> result =
           JSObject::DefineAccessor(it, getter, setter, attrs);
       if (result.is_null()) return false;

test/mjsunit/mjsunit.status

@@ -349,9 +349,6 @@
 
   # BUG(v8:3097)
   'debug-references': [SKIP],
-
-  # BUG(v8:4534)
-  'accessor-map-sharing': [SKIP],
 }],  # 'gc_stress == True'
 
 ##############################################################################

test/mjsunit/regress/regress-4534.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var dp = Object.defineProperty;
+function getter() { return 111; }
+function setter(x) { print(222); }
+obj1 = {};
+dp(obj1, "golf", { get: getter, configurable: true });
+dp(obj1, "golf", { set: setter, configurable: true });
+gc();
+obj2 = {};
+dp(obj2, "golf", { get: getter, configurable: true });
+dp(obj2, "golf", { set: setter, configurable: true });
+assertTrue(%HaveSameMap(obj1, obj2));