Fix accessor map transitions vs. Object.defineProperty

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <sstream>
 
@@ skipping 6126 matching lines @@
       // of object O whose [[Get]], [[Set]], [[Enumerable]] and
       // [[Configurable]] attribute values are described by Desc. If the value
       // of an attribute field of Desc is absent, the attribute of the newly
       // created property is set to its default value.
       if (!object->IsUndefined()) {
         if (!desc->has_enumerable()) desc->set_enumerable(false);
         if (!desc->has_configurable()) desc->set_configurable(false);
         Handle<Object> getter(
             desc->has_get()
                 ? desc->get()
-                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+                : Handle<Object>::cast(isolate->factory()->null_value()));
         Handle<Object> setter(
             desc->has_set()
                 ? desc->set()
-                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+                : Handle<Object>::cast(isolate->factory()->null_value()));
         MaybeHandle<Object> result =
             JSObject::DefineAccessor(it, getter, setter, desc->ToAttributes());
         if (result.is_null()) return false;
       }
     }
     // 2e. Return true.
     return true;
   }
   // 3. Return true, if every field in Desc is absent.
   // 4. Return true, if every field in Desc also occurs in current and the
@@ skipping 172 matching lines @@
       MaybeHandle<Object> result = JSObject::DefineOwnPropertyIgnoreAttributes(
           it, value, attrs, JSObject::DONT_FORCE_FIELD);
       if (result.is_null()) return false;
     } else {
       DCHECK(desc_is_accessor_descriptor ||
              (desc_is_generic_descriptor &&
               PropertyDescriptor::IsAccessorDescriptor(&current)));
       Handle<Object> getter(
           desc->has_get()
               ? desc->get()
-              : current.has_get() ? current.get()
-                                  : Handle<Object>::cast(
-                                        isolate->factory()->undefined_value()));
+              : current.has_get()
+                    ? current.get()
+                    : Handle<Object>::cast(isolate->factory()->null_value()));
       Handle<Object> setter(
           desc->has_set()
               ? desc->set()
-              : current.has_set() ? current.set()
-                                  : Handle<Object>::cast(
-                                        isolate->factory()->undefined_value()));
+              : current.has_set()
+                    ? current.set()
+                    : Handle<Object>::cast(isolate->factory()->null_value()));
       MaybeHandle<Object> result =
           JSObject::DefineAccessor(it, getter, setter, attrs);
       if (result.is_null()) return false;
     }
   }
 
   // 11. Return true.
   return true;
 }
 
@@ skipping 11670 matching lines @@
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 
 }  // namespace internal
 }  // namespace v8