Index: src/ic.cc |
diff --git a/src/ic.cc b/src/ic.cc |
index 687960f6ea6227f54d3e6850a4a543053e247492..ae7bb2129c9595a5ff88237677014f2d0c319c41 100644 |
--- a/src/ic.cc |
+++ b/src/ic.cc |
@@ -1205,7 +1205,8 @@ static bool LookupForWrite(Handle<JSObject> receiver, |
if (lookup->IsReadOnly() || !lookup->IsCacheable()) return false; |
if (lookup->holder() == *receiver) return lookup->CanHoldValue(value); |
- if (lookup->IsPropertyCallbacks()) return true; |
+ if (lookup->IsPropertyCallbacks() && |
+ !lookup->GetCallbackObject()->IsExecutableAccessorInfo()) return true; |
// JSGlobalProxy either stores on the global object in the prototype, or |
// goes into the runtime if access checks are needed, so this is always |
// safe. |