Fix crash when using Object.getOwnPropertyDescriptor on an API defined...

src/runtime.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 579 matching lines @@
   CONVERT_CHECKED(JSObject, obj, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
 
   // Use recursive implementation to also traverse hidden prototypes
   GetOwnPropertyImplementation(obj, name, &result);
 
   if (!result.IsProperty())
     return Heap::undefined_value();
 
   if (result.type() == CALLBACKS) {
-    elms->set(0, Heap::true_value());
     Object* structure = result.GetCallbackObject();
     if (structure->IsProxy()) {
-       Object* value = obj->GetPropertyWithCallback(
-             obj, structure, name, result.holder());
-       elms->set(1, value);
-       elms->set(2, Heap::ToBoolean(!result.IsReadOnly()));
-    } else {
+      // Property that is internally implemented as a callback.
+      Object* value = obj->GetPropertyWithCallback(
+          obj, structure, name, result.holder());
+      elms->set(0, Heap::false_value());
+      elms->set(1, value);
+      elms->set(2, Heap::ToBoolean(!result.IsReadOnly()));
+    } else if (structure->IsFixedArray()) {
+      // __defineGetter__/__defineSetter__ callback.
+      elms->set(0, Heap::true_value());
       elms->set(1, FixedArray::cast(structure)->get(0));
       elms->set(2, FixedArray::cast(structure)->get(1));
+    } else {
+      // TODO(ricow): Handle API callbacks.
+      return Heap::undefined_value();
     }
   } else {
     elms->set(0, Heap::false_value());
     elms->set(1, result.GetLazyValue());
     elms->set(2, Heap::ToBoolean(!result.IsReadOnly()));
   }
 
   elms->set(3, Heap::ToBoolean(!result.IsDontEnum()));
   elms->set(4, Heap::ToBoolean(!result.IsReadOnly()));
   return *desc;
@@ skipping 7524 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage(false);
   }
 }
 
 
 } }  // namespace v8::internal