When redefining accessor properties, defensively copy AccessorPairs.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index c317f0abf70eaacf1aaf3c7820a5affc3e86d17e..08fb84cbf13ac80e1186cbaa3410cfbc3de6ab0f 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4471,9 +4471,14 @@ MaybeObject* JSObject::DefinePropertyAccessor(String* name,
       Object* obj = result.GetCallbackObject();
       // Need to preserve old getters/setters.
       if (obj->IsAccessorPair()) {
-        AccessorPair::cast(obj)->set(is_getter, fun);
+        AccessorPair* copy;
+        { MaybeObject* maybe_copy =
+              AccessorPair::cast(obj)->CopyWithoutTransitions();
+          if (!maybe_copy->To(&copy)) return maybe_copy;
+        }
+        copy->set(is_getter, fun);
         // Use set to update attributes.
-        { MaybeObject* maybe_ok = SetPropertyCallback(name, obj, attributes);
+        { MaybeObject* maybe_ok = SetPropertyCallback(name, copy, attributes);
           if (maybe_ok->IsFailure()) return maybe_ok;
         }
         return GetHeap()->undefined_value();