Fix accessor lookup in crankshaft.

Seeing monomorphic type feedback plus an AccessorPair does not necessarily imply
that the corresponding getter/setter is really there, so we have to check for
this explictly.

TEST=mjsunit/object-define-property

Review URL: https://chromiumcodereview.appspot.com/10825384

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.h

@@ -1132,15 +1132,6 @@ class HGraphBuilder: public AstVisitor {
                                    bool is_store,
                                    bool* has_side_effects);
 
-  // Tries to find a JavaScript accessor of the given name in the prototype
-  // chain starting at the given map. Return true iff there is one, including
-  // the corresponding AccessorPair plus its holder (which could be null when
-  // the accessor is found directly in the given map).
-  bool LookupAccessorPair(Handle<Map> map,
-                          Handle<String> name,
-                          Handle<AccessorPair>* accessors,
-                          Handle<JSObject>* holder);
-
   HLoadNamedField* BuildLoadNamedField(HValue* object,
                                        Handle<Map> map,
                                        LookupResult* result,
@@ -1150,7 +1141,7 @@ class HGraphBuilder: public AstVisitor {
                                       Property* expr);
   HInstruction* BuildCallGetter(HValue* object,
                                 Handle<Map> map,
-                                Handle<AccessorPair> accessors,
+                                Handle<JSFunction> getter,
                                 Handle<JSObject> holder);
   HInstruction* BuildLoadNamedMonomorphic(HValue* object,
                                           Handle<String> name,
@@ -1177,7 +1168,7 @@ class HGraphBuilder: public AstVisitor {
   HInstruction* BuildCallSetter(HValue* object,
                                 HValue* value,
                                 Handle<Map> map,
-                                Handle<AccessorPair> accessors,
+                                Handle<JSFunction> setter,
                                 Handle<JSObject> holder);
   HInstruction* BuildStoreNamedMonomorphic(HValue* object,
                                            Handle<String> name,

test/mjsunit/object-define-property.js

@@ -1172,3 +1172,19 @@ try {
   assertTrue(/which has only a getter/.test(e));
 }
 assertTrue(exception);
+
+// Test assignment to a getter-only property on the prototype chain. This makes
+// sure that crankshaft re-checks its assumptions and doesn't rely only on type
+// feedback (which would be monomorphic here).
+
+function Assign(o) {
+  o.blubb = 123;
+}
+
+function C() {}
+
+Assign(new C);
+Assign(new C);
+%OptimizeFunctionOnNextCall(Assign);
+Object.defineProperty(C.prototype, "blubb", {get: function() { return -42; }});
+Assign(new C);