ic: perform interceptor query in LookupForWrite

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 163172d8eb4df42e68c395c528f1864fb68ca49c..641fe0d29ce957c4835b1b9033303e465204b806 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1607,13 +1607,22 @@ static bool LookupForWrite(Handle<JSObject> receiver,
     if (lookup->IsReadOnly() || !lookup->IsCacheable()) return false;
 
     if (lookup->holder() == *receiver) {
-      if (lookup->IsInterceptor() &&
-          receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
-        receiver->LocalLookupRealNamedProperty(*name, lookup);
-        return lookup->IsFound() &&
-            !lookup->IsReadOnly() &&
-            lookup->CanHoldValue(value) &&
-            lookup->IsCacheable();
+      if (lookup->IsInterceptor()) {
+        bool found_and_writable;
+        if (receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
+          receiver->LocalLookupRealNamedProperty(*name, lookup);
+          found_and_writable = lookup->IsFound() &&
+                               !lookup->IsReadOnly() &&
+                               lookup->CanHoldValue(value);
+        } else {
+          ASSERT(lookup->representation()->IsNone());

[Toon Verwaest, 2013/09/23 13:09:59]

Why would the representation be none? It's explicitly set to Tagged in
InterceptorResult in src/property.h

+          PropertyAttributes attrs =
+              lookup->holder()->GetPropertyAttributeWithInterceptor(*receiver,
+                                                                    *name,
+                                                                    true);
+          found_and_writable = attrs != ABSENT && (attrs & READ_ONLY) == 0;
+        }
+        return found_and_writable && lookup->IsCacheable();
       }
       return lookup->CanHoldValue(value);
     }