The probem is that when we have megamorphic fallback, getters/setters returned by findMegaMorphicGet/SetMethod would have a ScriptObject receiver (i.e., virtual methods.) There are several points in the code, WithObject in particular, that assumed the receiver was always an Object. My previous fix originally recast the receiver in findMegaMorphicGet/SetMethod, but this caused conversion issues in the get prop case. This fix brings uniformity to the set prop case.