Version 4.8.135.1 (cherry-pick)

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 1e5315b978e67fb8e9314cd993a5184f60ff3269..a010035e0cfc06e7e1a5cd36fd7832259242b914 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6053,6 +6053,11 @@ bool JSReceiver::OrdinaryDefineOwnProperty(LookupIterator* it,
       isolate->has_pending_exception()) {
     return false;
   }
+  // TODO(jkummerow/verwaest): It would be nice if we didn't have to reset
+  // the iterator every time. Currently, the reasons why we need it are:
+  // - handle interceptors correctly
+  // - handle accessors correctly (which might change the holder's map)
+  it->Restart();
   // 3. Let extensible be the value of the [[Extensible]] internal slot of O.
   Handle<JSObject> object = Handle<JSObject>::cast(it->GetReceiver());
   bool extensible = JSObject::IsExtensible(object);
@@ -6074,13 +6079,6 @@ bool JSReceiver::OrdinaryDefineOwnProperty(LookupIterator* it,
       }
       return false;
     }
-    // We have to reset the LookupIterator to handle interceptors properly.
-    Map* map = Handle<HeapObject>::cast(object)->map();
-    if ((it->IsElement() && map->has_indexed_interceptor()) ||
-        (!it->IsElement() && map->has_named_interceptor())) {
-      it->Restart();
-    }
-
     // 2c. If IsGenericDescriptor(Desc) or IsDataDescriptor(Desc) is true, then:
     // (This is equivalent to !IsAccessorDescriptor(desc).)
     DCHECK((desc_is_generic_descriptor || desc_is_data_descriptor) ==