Invalidate the global property cell when converting from data to accessor.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index bef1881acb1ecd73556dec4796bf350dbe0745bd..f594b41d4f9bd3264f04cc920115c5550091bd94 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -565,7 +565,15 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
   if (object->IsGlobalObject()) {
     Handle<PropertyCell> cell(
         PropertyCell::cast(property_dictionary->ValueAt(entry)));
-    PropertyCell::SetValueInferType(cell, value);
+    if (details.type() != property_dictionary->DetailsAt(entry).type()) {
+      Isolate* isolate = object->GetIsolate();
+      Handle<Object> hole = isolate->factory()->the_hole_value();
+      PropertyCell::SetValueInferType(cell, hole);
+      cell = isolate->factory()->NewPropertyCell(value);
+      property_dictionary->SetEntry(entry, name, cell, details);
+    } else {
+      PropertyCell::SetValueInferType(cell, value);
+    }
     // Please note we have to update the property details.
     property_dictionary->DetailsAtPut(entry, details);
   } else {
@@ -7411,12 +7419,7 @@ Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
   Isolate* isolate = name->GetIsolate();
 
   // Dictionary maps can always have additional data properties.
-  if (map->is_dictionary_map()) {
-    // For global objects, property cells are inlined. We need to change the
-    // map.
-    if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
-    return map;
-  }
+  if (map->is_dictionary_map()) return map;
 
   // Migrate to the newest map before transitioning to the new property.
   map = Update(map);