deps: backport 60c316 from v8 trunk

Original commit message:

    Extend the interceptor setter ASSERT to support the JSGlobalProxy case.

    BUG=v8:3463
    LOG=n
    R=dcarney@chromium.org

    Review URL: https://codereview.chromium.org/415973004

    git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

    Signed-off-by: Fedor Indutny <fedor@indutny.com>

fix #7969

deps/v8/src/stub-cache.cc

@@ -633,7 +633,18 @@ RUNTIME_FUNCTION(StoreInterceptorProperty) {
   Handle<JSObject> receiver = args.at<JSObject>(0);
   Handle<Name> name = args.at<Name>(1);
   Handle<Object> value = args.at<Object>(2);
-  ASSERT(receiver->HasNamedInterceptor());
+  if (receiver->IsJSGlobalProxy()) {
+    Object* proto = Object::cast(*receiver)->GetPrototype(isolate);
+#ifdef DEBUG
+    ASSERT(proto == NULL ||
+           JSGlobalObject::cast(proto)->HasNamedInterceptor());
+#endif
+    receiver = Handle<JSObject>(JSObject::cast(proto));
+  } else {
+#ifdef DEBUG
+    ASSERT(receiver->HasNamedInterceptor());
+#endif
+  }
   PropertyAttributes attr = NONE;
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(