[ic] Fix accessor to data reconfiguration case

... in object literals.

Bug: chromium:997056
Change-Id: Ifc210ff53b751c6ef26f16b73c9ac52426a845fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813021
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63894}

src/ic/keyed-store-generic.cc

@@ -810,7 +810,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
         var_accessor_holder = receiver;
         Goto(&accessor);
       } else {
-        Goto(&data_property);
+        // Handle accessor to data property reconfiguration in runtime.
+        Goto(slow);
       }
 
       BIND(&data_property);

test/mjsunit/regress/regress-crbug-997056.js

@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (let i = 0; i < 4; ++i) {
+    var obj1 = {
+        get [obj1]() {},
+        ...obj2,
+    };
+    var obj2 = { [obj1]: 0 };
+    print(obj2);
+}