Revert "Treat ExecutableAccessorInfo as regular data properties."

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/compiler.h"
 #include "src/contexts.h"
@@ skipping 173 matching lines @@
 
 void Accessors::ArrayLengthSetter(
     v8::Local<v8::String> name,
     v8::Local<v8::Value> val,
     const v8::PropertyCallbackInfo<void>& info) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
   HandleScope scope(isolate);
   Handle<JSObject> object = Handle<JSObject>::cast(
       Utils::OpenHandle(*info.This()));
   Handle<Object> value = Utils::OpenHandle(*val);
-  ASSERT(object->IsJSArray());
+  // This means one of the object's prototypes is a JSArray and the
+  // object does not have a 'length' property.  Calling SetProperty
+  // causes an infinite loop.
+  if (!object->IsJSArray()) {
+    MaybeHandle<Object> maybe_result = JSObject::SetOwnPropertyIgnoreAttributes(
+        object, isolate->factory()->length_string(), value, NONE);
+    maybe_result.Check();
+    return;
+  }
 
   value = FlattenNumber(isolate, value);
 
   Handle<JSArray> array_handle = Handle<JSArray>::cast(object);
   MaybeHandle<Object> maybe;
   Handle<Object> uint32_v;
   maybe = Execution::ToUint32(isolate, value);
   if (!maybe.ToHandle(&uint32_v)) {
     isolate->OptionalRescheduleException(false);
     return;
@@ skipping 650 matching lines @@
                                            Handle<JSObject> receiver,
                                            Handle<Object> value) {
   Handle<JSFunction> function;
   {
     DisallowHeapAllocation no_allocation;
     JSFunction* function_raw = FindInstanceOf<JSFunction>(isolate, *receiver);
     if (function_raw == NULL) return isolate->factory()->undefined_value();
     function = Handle<JSFunction>(function_raw, isolate);
   }
 
-  ASSERT(function->should_have_prototype());
+  if (!function->should_have_prototype()) {
+    // Since we hit this accessor, object will have no prototype property.
+    MaybeHandle<Object> maybe_result = JSObject::SetOwnPropertyIgnoreAttributes(
+        receiver, isolate->factory()->prototype_string(), value, NONE);
+    return maybe_result.ToHandleChecked();
+  }
 
   Handle<Object> old_value;
   bool is_observed = *function == *receiver && function->map()->is_observed();
   if (is_observed) {
     if (function->has_prototype())
       old_value = handle(function->prototype(), isolate);
     else
       old_value = isolate->factory()->NewFunctionPrototype(function);
   }
 
@@ skipping 531 matching lines @@
   info->set_data(Smi::FromInt(index));
   Handle<Object> getter = v8::FromCData(isolate, &ModuleGetExport);
   Handle<Object> setter = v8::FromCData(isolate, &ModuleSetExport);
   info->set_getter(*getter);
   if (!(attributes & ReadOnly)) info->set_setter(*setter);
   return info;
 }
 
 
 } }  // namespace v8::internal