[ic] Fix accessor set after map update transitioning to dict

Bug: chromium:979023
Change-Id: Ief42ed100478c0b741051a5ca123dc807e2a6dca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687671
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62501}

src/objects/map.cc

@@ -2217,12 +2217,12 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
   DCHECK(!getter->IsNull(isolate) || !setter->IsNull(isolate));
   DCHECK(name->IsUniqueName());
 
-  // Dictionary maps can always have additional data properties.
-  if (map->is_dictionary_map()) return map;
-
   // Migrate to the newest map before transitioning to the new property.
   map = Update(isolate, map);
 
+  // Dictionary maps can always have additional data properties.
+  if (map->is_dictionary_map()) return map;
+
   PropertyNormalizationMode mode = map->is_prototype_map()
                                        ? KEEP_INOBJECT_PROPERTIES
                                        : CLEAR_INOBJECT_PROPERTIES;

test/mjsunit/regress/regress-crbug-979023.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(arg) {
+  var ret = { x: arg };
+  Object.defineProperty(ret, "y", {
+    get: function () { },
+    configurable: true
+  });
+  return ret;
+}
+let v0 = foo(10);
+let v1 = foo(10.5);
+Object.defineProperty(v0, "y", {
+  get: function () { },
+  configurable: true
+});