Fix crash with indexed setter on objects without corresponding getter.

test/mjsunit/indexed-accessors.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 80 matching lines @@
 assertEquals(1, a.length);
 a[5] = 42;
 assertEquals(0, b);
 assertEquals(42, a[5]);
 assertEquals(6, a.length);
 
 // Using a setter where only a getter is defined throws an exception.
 var q = {};
 q.__defineGetter__('0', function() { return 42; });
 assertThrows('q[0] = 7');
+
+// Using a getter where only a setter is defined returns undefined.
+var q1 = {};
+q1.__defineSetter__('0', function() {q1.b = 17;});
+assertEquals(q1[0], undefined);
+// Setter works
+q1[0] = 3;
+assertEquals(q1[0], undefined);
+assertEquals(q1.b, 17);
+
+// Complex case of using an undefined getter.
+// From http://code.google.com/p/v8/issues/detail?id=298
+// Reported by nth10sd.
+
+a = function() {};
+__defineSetter__("0", function() {});
+if (a |= '') {};
+assertThrows('this[a].__parent__');
+assertEquals(a, 0);
+assertEquals(this[a], undefined);