Fix Object.freeze for objects with mixed accessors and data properties

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 99fd8e21f0a6dfd0ba2019289caf06c770f241a0..c5abb109cd9ff3df0e4d5fb64bf0447638c6421a 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6744,11 +6744,14 @@ MaybeObject* DescriptorArray::CopyUpToAddAttributes(
     for (int i = 0; i < size; ++i) {
       Object* value = GetValue(i);
       PropertyDetails details = GetDetails(i);
+      int mask = DONT_DELETE | DONT_ENUM;

[Toon Verwaest, 2013/05/25 10:52:59]

This is very confusing to me. Don't we just want to add DONT_DELETE and
DONT_ENUM to all attributes of a frozen object (so add it to the client of
CopyUpToAddAttributes), and still mask out READ_ONLY from all callbacks; cause
it's never valid?

In this version it doesn't look like a generic CopyUpToAddAttributes at all...

       // READ_ONLY is an invalid attribute for JS setters/getters.
-      if (details.type() == CALLBACKS && value->IsAccessorPair()) {
-        attributes = static_cast<PropertyAttributes>(attributes & ~READ_ONLY);
+      if (details.type() != CALLBACKS || !value->IsAccessorPair()) {
+        mask |= READ_ONLY;
       }
-      Descriptor desc(GetKey(i), value, details.CopyAddAttributes(attributes));
+      details = details.CopyAddAttributes(
+          static_cast<PropertyAttributes>(attributes & mask));
+      Descriptor desc(GetKey(i), value, details);
       descriptors->Set(i, &desc, witness);
     }
   } else {