| Index: src/ic.cc
|
| diff --git a/src/ic.cc b/src/ic.cc
|
| index 687960f6ea6227f54d3e6850a4a543053e247492..ae7bb2129c9595a5ff88237677014f2d0c319c41 100644
|
| --- a/src/ic.cc
|
| +++ b/src/ic.cc
|
| @@ -1205,7 +1205,8 @@ static bool LookupForWrite(Handle<JSObject> receiver,
|
|
|
| if (lookup->IsReadOnly() || !lookup->IsCacheable()) return false;
|
| if (lookup->holder() == *receiver) return lookup->CanHoldValue(value);
|
| - if (lookup->IsPropertyCallbacks()) return true;
|
| + if (lookup->IsPropertyCallbacks() &&
|
| + !lookup->GetCallbackObject()->IsExecutableAccessorInfo()) return true;
|
| // JSGlobalProxy either stores on the global object in the prototype, or
|
| // goes into the runtime if access checks are needed, so this is always
|
| // safe.
|
|
|