Fix the behavior of 'super.foo' assignment when receiver is not an object.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 3261 matching lines @@
 
 MaybeHandle<Object> Object::SetSuperProperty(LookupIterator* it,
                                              Handle<Object> value,
                                              LanguageMode language_mode,
                                              StoreFromKeyed store_mode) {
   bool found = false;
   MaybeHandle<Object> result =
       SetPropertyInternal(it, value, language_mode, store_mode, &found);
   if (found) return result;
 
+  if (!it->GetReceiver()->IsJSReceiver()) {
+    return WriteToReadOnlyProperty(it->isolate(), it->GetReceiver(), it->name(),
+                                   value, language_mode);
+  }
+
   LookupIterator own_lookup(it->GetReceiver(), it->name(), LookupIterator::OWN);
 
   switch (own_lookup.state()) {
     case LookupIterator::NOT_FOUND:
       return JSObject::AddDataProperty(&own_lookup, value, NONE, language_mode,
                                        store_mode);
 
     case LookupIterator::INTEGER_INDEXED_EXOTIC:
       return result;
 
@@ skipping 13948 matching lines @@
 void PropertyCell::SetValueWithInvalidation(Handle<PropertyCell> cell,
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 } }  // namespace v8::internal