| Index: src/lookup.cc
|
| diff --git a/src/lookup.cc b/src/lookup.cc
|
| index 4a89b7f378ba10990bf31005d9eabf26f2786671..95d5e54d53f85ccd3ccdbb463e95e24c8ab266bd 100644
|
| --- a/src/lookup.cc
|
| +++ b/src/lookup.cc
|
| @@ -381,10 +381,19 @@ void LookupIterator::TransitionToAccessorProperty(
|
| Handle<JSObject> receiver = GetStoreTarget();
|
|
|
| if (!IsElement() && !receiver->map()->is_dictionary_map()) {
|
| - holder_ = receiver;
|
| Handle<Map> old_map(receiver->map(), isolate_);
|
| +
|
| + if (!holder_.is_identical_to(receiver)) {
|
| + holder_ = receiver;
|
| + state_ = NOT_FOUND;
|
| + } else if (state_ == INTERCEPTOR) {
|
| + LookupInRegularHolder<false>(*old_map, *holder_);
|
| + }
|
| + int descriptor =
|
| + IsFound() ? static_cast<int>(number_) : DescriptorArray::kNotFound;
|
| +
|
| Handle<Map> new_map = Map::TransitionToAccessorProperty(
|
| - old_map, name_, component, accessor, attributes);
|
| + old_map, name_, descriptor, component, accessor, attributes);
|
| bool simple_transition = new_map->GetBackPointer() == receiver->map();
|
| JSObject::MigrateToMap(receiver, new_map);
|
|
|
|
|