Fix accessor lookup in crankshaft.

test/mjsunit/object-define-property.js

Index: test/mjsunit/object-define-property.js
diff --git a/test/mjsunit/object-define-property.js b/test/mjsunit/object-define-property.js
index 56e67c3c23ae69758a3b0ac96e00ad1b0c84749c..6771412eb6d9167c9ec0f7ecf740325ce953953f 100644
--- a/test/mjsunit/object-define-property.js
+++ b/test/mjsunit/object-define-property.js
@@ -1172,3 +1172,19 @@ try {
   assertTrue(/which has only a getter/.test(e));
 }
 assertTrue(exception);
+
+// Test assignment to a getter-only property on the prototype chain. This makes
+// sure that crankshaft re-checks its assumptions and doesn't rely only on type
+// feedback (which would be monomorphic here).
+
+function Assign(o) {
+  o.blubb = 123;
+}
+
+function C() {}
+
+Assign(new C);
+Assign(new C);
+%OptimizeFunctionOnNextCall(Assign);
+Object.defineProperty(C.prototype, "blubb", {get: function() { return -42; }});
+Assign(new C);