I was looking at a profile in bug 802157 and discovered that with ion we're spending a ton of time under ion::SetPropertyCache. The reason for that is that the testcase does an assignment like so: foo.bar = something; where "bar" is a readonly accessor prop (so has a getter, but no setter provided) on foo.__proto__ in this case. But SetPropertyCache only caches own properties with slots, so we keep missing the cache over and over. Seems like this specific case (non-strict mode, set of readonly prop) should be pretty easy to cache... it's a no-op.

Yeah, this should be pretty straightforward - I think just a shape guard and jump back to the inline path.