Rollback of r13728 in 3.17 branch.

src/property.h

Index: src/property.h
diff --git a/src/property.h b/src/property.h
index 0500e57ae48ff093566f640b9ecc246fb5199fab..7f5d266df24cefc63d9d72e12bf18b6434a71893 100644
--- a/src/property.h
+++ b/src/property.h
@@ -203,6 +203,16 @@ class LookupResult BASE_EMBEDDED {
     number_ = number;
   }
 
+  void ConstantResult(JSObject* holder) {
+    lookup_type_ = CONSTANT_TYPE;
+    holder_ = holder;
+    details_ =
+        PropertyDetails(static_cast<PropertyAttributes>(DONT_ENUM |
+                                                        DONT_DELETE),
+                        CALLBACKS);
+    number_ = -1;
+  }
+
   void DictionaryResult(JSObject* holder, int entry) {
     lookup_type_ = DICTIONARY_TYPE;
     holder_ = holder;
@@ -419,7 +429,10 @@ class LookupResult BASE_EMBEDDED {
   }
 
   Object* GetCallbackObject() {
-    ASSERT(type() == CALLBACKS && !IsTransition());
+    if (lookup_type_ == CONSTANT_TYPE) {
+      return HEAP->prototype_accessors();
+    }
+    ASSERT(!IsTransition());
     return GetValue();
   }
 
@@ -455,7 +468,8 @@ class LookupResult BASE_EMBEDDED {
     TRANSITION_TYPE,
     DICTIONARY_TYPE,
     HANDLER_TYPE,
-    INTERCEPTOR_TYPE
+    INTERCEPTOR_TYPE,
+    CONSTANT_TYPE
   } lookup_type_;
 
   JSReceiver* holder_;