[ic] Respect PropertyDetails::KindField when following transitions

Bug: chromium:897514
Change-Id: Ie7950a2caa2e63e102096a6a36475351259ea854
Reviewed-on: https://chromium-review.googlesource.com/c/1293955
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56870}

src/ic/accessor-assembler.cc

@@ -999,11 +999,15 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
     // 1) name is a non-private symbol and attributes equal to NONE,
     // 2) name is a private symbol and attributes equal to DONT_ENUM.
     Label attributes_ok(this);
-    const int kAttributesDontDeleteReadOnlyMask =
+    const int kKindAndAttributesDontDeleteReadOnlyMask =
+        PropertyDetails::KindField::kMask |
         PropertyDetails::kAttributesDontDeleteMask |
         PropertyDetails::kAttributesReadOnlyMask;
-    // Both DontDelete and ReadOnly attributes must not be set.
-    GotoIf(IsSetWord32(details, kAttributesDontDeleteReadOnlyMask), miss);
+    STATIC_ASSERT(kData == 0);
+    // Both DontDelete and ReadOnly attributes must not be set and it has to be
+    // a kData property.
+    GotoIf(IsSetWord32(details, kKindAndAttributesDontDeleteReadOnlyMask),
+           miss);
 
     // DontEnum attribute is allowed only for private symbols and vice versa.
     Branch(Word32Equal(

test/mjsunit/regress/regress-crbug-897514.js

@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Create transtion => 'get a'.
+let o = {};
+Object.defineProperty(o, 'a', {
+    enumerable: true,
+    configurable: true,
+    get: function() { return 7 }
+});
+
+function spread(o) {
+  let result = { ...o };
+  %HeapObjectVerify(result);
+  return result;
+}
+
+for (let i = 0; i<3; i++) {
+  spread([]);
+  // Use different transition => 'a'.
+  spread({ a:0 });
+  spread("abc");
+}