Expect access check in JSObject::DefineAccessor.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 4459a5b05cafabe7e0dae338d501e358e3ffedf2..f73d33f2a8edffb2e338bd956df8507e8dde9b34 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6147,7 +6147,10 @@ MaybeHandle<Object> JSObject::DefineAccessor(Handle<JSObject> object,
     // At least one of the accessors needs to be a new value.
     DCHECK(!getter->IsNull() || !setter->IsNull());
     LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
-    CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
+    if (it.state() == LookupIterator::ACCESS_CHECK) {
+      // We already did an access check before. We do have access.
+      it.Next();
+    }
     if (!getter->IsNull()) {
       it.TransitionToAccessorProperty(ACCESSOR_GETTER, getter, attributes);
     }