Fix accessor lookup in crankshaft.

test/mjsunit/object-define-property.js

Index: test/mjsunit/object-define-property.js
diff --git a/test/mjsunit/object-define-property.js b/test/mjsunit/object-define-property.js
index 56e67c3c23ae69758a3b0ac96e00ad1b0c84749c..ad38723c6ddb6416f1607b59397e8c264049c88f 100644
--- a/test/mjsunit/object-define-property.js
+++ b/test/mjsunit/object-define-property.js
@@ -1172,3 +1172,17 @@ try {
   assertTrue(/which has only a getter/.test(e));
 }
 assertTrue(exception);
+
+// Test assignment to a getter-only property on the prototype chain.

[Michael Starzinger, 2012/08/16 09:55:58]

Can we extend this comment to say that it actually tests that Crankshaft doesn't
solely rely on type-feedback but rechecks assumptions.

[Sven Panne, 2012/08/16 10:47:40]

Done.

+
+function Assign(o) {
+  o.blubb = 123;
+}
+
+function C() {}
+
+Assign(new C);
+Assign(new C);
+%OptimizeFunctionOnNextCall(Assign);
+Object.defineProperty(C.prototype, "blubb", {get: function() { return -42; }});
+Assign(new C);