Fix Object.freeze for objects with mixed accessors and data properties

Fix Object.freeze for objects with mixed accessors and data properties

The bug in the existing code was that it modified the |attributes|
local variable on its way through the loop in CopyUpToAddAttributes.
But that affected any properties updated after an accessor property.
The code now sets up a mask each time and applies that instead of
mutating |attributes|.

R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=14818

[adamk, 2013-05-25 00:52:49]

This should unblock the V8 roll. Stupid, stupid bug...

[Toon Verwaest, 2013-05-25 10:52:59]

https://codereview.chromium.org/16051002/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/16051002/diff/1/src/objects.cc#newcode6747
src/objects.cc:6747: int mask = DONT_DELETE | DONT_ENUM;
This is very confusing to me. Don't we just want to add DONT_DELETE and
DONT_ENUM to all attributes of a frozen object (so add it to the client of
CopyUpToAddAttributes), and still mask out READ_ONLY from all callbacks; cause
it's never valid?

In this version it doesn't look like a generic CopyUpToAddAttributes at all...

[Toon Verwaest, 2013-05-27 10:55:58]

Nevermind my comments. I obviously didn't review it properly. lgtm :)

[Toon Verwaest, 2013-05-27 10:56:34]

Committed patchset #1 manually as r14818 (presubmit successful).