Fix loading non-configurable non-writable value from a constant with mismatching type feedback

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <algorithm>
 
 #include "src/v8.h"
 
@@ skipping 5774 matching lines @@
                                                 Handle<Map> map) {
   BuildCheckHeapObject(object);
   return Add<HCheckMaps>(object, map);
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
     PropertyAccessInfo* info,
     HValue* checked_object) {
   // See if this is a load for an immutable property
-  if (checked_object->ActualValue()->IsConstant() && info->IsReadOnly() &&
-      !info->IsConfigurable()) {
+  if (checked_object->ActualValue()->IsConstant()) {
     Handle<Object> object(
         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
 
     if (object->IsJSObject()) {
       LookupIterator it(object, info->name(), LookupIterator::OWN_PROPERTY);
       Handle<Object> value = JSObject::GetDataProperty(&it);
-      CHECK(it.IsFound());
-      return New<HConstant>(value);
+      if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
+        return New<HConstant>(value);
+      }
     }
   }
 
   HObjectAccess access = info->access();
   if (access.representation().IsDouble()) {
     // Load the heap number.
     checked_object = Add<HLoadNamedField>(
         checked_object, static_cast<HValue*>(NULL),
         access.WithRepresentation(Representation::Tagged()));
     // Load the double value from it.
@@ skipping 6674 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal