Use trampoline or handlified JSObject::SetLocalPropertyIgnoreAttributes.

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 766d4da7d0760125078704b933909c4538805406..8be0439049507a383578ae40a091092479928893 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -113,7 +113,7 @@ MaybeObject* Accessors::ArraySetLength(Isolate* isolate,
   // object does not have a 'length' property.  Calling SetProperty
   // causes an infinite loop.
   if (!object->IsJSArray()) {
-    return object->SetLocalPropertyIgnoreAttributes(
+    return object->SetLocalPropertyIgnoreAttributesTrampoline(
         isolate->heap()->length_string(), value, NONE);
   }
 
@@ -531,9 +531,8 @@ MaybeObject* Accessors::FunctionSetPrototype(Isolate* isolate,
   if (function_raw == NULL) return heap->undefined_value();
   if (!function_raw->should_have_prototype()) {
     // Since we hit this accessor, object will have no prototype property.
-    return object->SetLocalPropertyIgnoreAttributes(heap->prototype_string(),
-                                                    value_raw,
-                                                    NONE);
+    return object->SetLocalPropertyIgnoreAttributesTrampoline(
+        heap->prototype_string(), value_raw, NONE);
   }
 
   HandleScope scope(isolate);