Treat ExecutableAccessorInfo as regular data properties.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 3062 matching lines @@
       case INTERCEPTOR: {
         LookupIterator it(object, name, handle(result.holder()));
         PropertyAttributes attr = GetPropertyAttributes(&it);
         *done = !!(attr & READ_ONLY);
         break;
       }
       case CALLBACKS: {
         *done = true;
         if (!result.IsReadOnly()) {
           Handle<Object> callback_object(result.GetCallbackObject(), isolate);
+          // Only store via executable access info setters if the holder is the
+          // receiver or on its hidden prototype chain.
+          if (callback_object->IsExecutableAccessorInfo()) {
+            Handle<JSObject> current = object;
+            while (*current != result.holder()) {
+              // There is a callbacks holder, so we are guaranteed that all
+              // objects in between are JSObjects.
+              Handle<JSObject> prototype(
+                  JSObject::cast(current->GetPrototype()));
+              if (!current->IsJSGlobalProxy() &&
+                  !prototype->map()->is_hidden_prototype()) {
+                *done = result.IsReadOnly();

[mvstanton, 2014/07/03 09:33:08]

How about *done = false, because result.IsReadOnly() is false at this point.

+                break;
+              }
+              current = prototype;
+            }
+            if (*current != result.holder()) break;

[mvstanton, 2014/07/03 09:33:08]

comment to explain this break.

+          }
           return SetPropertyWithCallback(object, name, value,
                                          handle(result.holder()),
                                          callback_object, strict_mode);
         }
         break;
       }
       case HANDLER: {
         Handle<JSProxy> proxy(result.proxy());
         return JSProxy::SetPropertyViaPrototypesWithHandler(
             proxy, object, name, value, attributes, strict_mode, done);
@@ skipping 13876 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal