Invalidate the global property cell when converting from data to accessor.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 547 matching lines @@
     enumeration_index = original_details.dictionary_index();
     DCHECK(enumeration_index > 0);
   }
 
   details = PropertyDetails(
       details.attributes(), details.type(), enumeration_index);
 
   if (object->IsGlobalObject()) {
     Handle<PropertyCell> cell(
         PropertyCell::cast(property_dictionary->ValueAt(entry)));
-    PropertyCell::SetValueInferType(cell, value);
+    if (details.type() != property_dictionary->DetailsAt(entry).type()) {
+      Isolate* isolate = object->GetIsolate();
+      Handle<Object> hole = isolate->factory()->the_hole_value();
+      PropertyCell::SetValueInferType(cell, hole);
+      cell = isolate->factory()->NewPropertyCell(value);
+      property_dictionary->SetEntry(entry, name, cell, details);
+    } else {
+      PropertyCell::SetValueInferType(cell, value);
+    }
     // Please note we have to update the property details.
     property_dictionary->DetailsAtPut(entry, details);
   } else {
     property_dictionary->SetEntry(entry, name, value, details);
   }
 }
 
 
 static MaybeHandle<JSObject> FindIndexedAllCanReadHolder(
     Isolate* isolate, Handle<JSObject> js_object,
@@ skipping 6825 matching lines @@
 
 
 Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
                                               Handle<Name> name,
                                               AccessorComponent component,
                                               Handle<Object> accessor,
                                               PropertyAttributes attributes) {
   Isolate* isolate = name->GetIsolate();
 
   // Dictionary maps can always have additional data properties.
-  if (map->is_dictionary_map()) {
-    // For global objects, property cells are inlined. We need to change the
-    // map.
-    if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
-    return map;
-  }
+  if (map->is_dictionary_map()) return map;
 
   // Migrate to the newest map before transitioning to the new property.
   map = Update(map);
 
   PropertyNormalizationMode mode = map->is_prototype_map()
                                        ? KEEP_INOBJECT_PROPERTIES
                                        : CLEAR_INOBJECT_PROPERTIES;
 
   int index = map->SearchTransition(kAccessor, *name, attributes);
   if (index != TransitionArray::kNotFound) {
@@ skipping 9706 matching lines @@
                                                CompilationInfo* info) {
   Handle<DependentCode> codes = DependentCode::InsertCompilationInfo(
       handle(cell->dependent_code(), info->isolate()),
       DependentCode::kPropertyCellChangedGroup, info->object_wrapper());
   if (*codes != cell->dependent_code()) cell->set_dependent_code(*codes);
   info->dependencies(DependentCode::kPropertyCellChangedGroup)->Add(
       cell, info->zone());
 }
 
 } }  // namespace v8::internal