Invalidate the global property cell when converting from data to accessor.

src/ic/handler-compiler.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_HANDLER_COMPILER_H_
 #define V8_IC_HANDLER_COMPILER_H_
 
 #include "src/ic/access-compiler.h"
 #include "src/ic/ic-state.h"
 
@@ skipping 77 matching lines @@
   // code for security check in case of global object holders. Helps to make
   // sure that the current IC is still valid.
   //
   // The scratch and holder registers are always clobbered, but the object
   // register is only clobbered if it the same as the holder register. The
   // function returns a register containing the holder - either object_reg or
   // holder_reg.
   Register CheckPrototypes(Register object_reg, Register holder_reg,
                            Register scratch1, Register scratch2,
                            Handle<Name> name, Label* miss,
-                           PrototypeCheckType check = CHECK_ALL_MAPS);
+                           PrototypeCheckType check);
 
   Handle<Code> GetCode(Code::Kind kind, Code::StubType type, Handle<Name> name);
   void set_holder(Handle<JSObject> holder) { holder_ = holder; }
   Handle<Map> map() const { return map_; }
   void set_map(Handle<Map> map) { map_ = map; }
   Handle<JSObject> holder() const { return holder_; }
 
  private:
   Handle<Map> map_;
   Handle<JSObject> holder_;
@@ skipping 181 matching lines @@
 
   void CompileElementHandlers(MapHandleList* receiver_maps,
                               CodeHandleList* handlers);
 
   static void GenerateStoreSlow(MacroAssembler* masm);
 };
 }
 }  // namespace v8::internal
 
 #endif  // V8_IC_HANDLER_COMPILER_H_