Added Crankshaft support for setters.

test/mjsunit/regress/regress-crbug-125148.js

Index: test/mjsunit/regress/regress-crbug-125148.js
diff --git a/test/mjsunit/regress/regress-crbug-125148.js b/test/mjsunit/regress/regress-crbug-125148.js
index 142f14035c2f45dd53ce022893fe5649ee18aeb9..0f7bcd8cab28f87b0148a935846d1b80216be089 100644
--- a/test/mjsunit/regress/regress-crbug-125148.js
+++ b/test/mjsunit/regress/regress-crbug-125148.js
@@ -66,3 +66,25 @@ assertEquals(111, boo(C));
 ToDictionaryMode(B);
 %OptimizeFunctionOnNextCall(boo);
 assertEquals(111, boo(C));
+
+// And once more for setters...
+A = {};
+Object.defineProperty(A, "huh", { set: function(x) { assertUnreachable(); }});
+
+B = Object.create(A);
+var setterValue;
+Object.defineProperty(B, "huh", { set: function(x) { setterValue = x; }});
+
+C = Object.create(B);
+
+function fuu(x) {
+  setterValue = 222;
+  x.huh = 111;
+  return setterValue;
+}
+
+assertEquals(111, fuu(C));
+assertEquals(111, fuu(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(fuu);
+assertEquals(111, fuu(C));