Reconfigure on the right holder, which might be a hidden object.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 4162 matching lines @@
             it->isolate(), Handle<ExecutableAccessorInfo>::cast(accessors));
         new_data->set_property_attributes(attributes);
         // By clearing the setter we don't have to introduce a lookup to
         // the setter, simply make it unavailable to reflect the
         // attributes.
         if (attributes & READ_ONLY) {
           ExecutableAccessorInfo::ClearSetter(new_data);
         }
 
         if (it->IsElement()) {
-          SetElementCallback(object, it->index(), new_data, attributes);
+          SetElementCallback(it->GetHolder<JSObject>(), it->index(), new_data,
+                             attributes);
         } else {
-          SetPropertyCallback(object, it->name(), new_data, attributes);
+          SetPropertyCallback(it->GetHolder<JSObject>(), it->name(), new_data,
+                              attributes);
         }
         if (is_observed) {
           RETURN_ON_EXCEPTION(
               it->isolate(),
               EnqueueChangeRecord(object, "reconfigure", it->GetName(),
                                   it->factory()->the_hole_value()),
               Object);
         }
         return value;
       }
@@ skipping 12530 matching lines @@
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 }  // namespace internal
 }  // namespace v8