Fix another corner-case behavior of Object::SetSuperProperty.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <sstream>
 
@@ skipping 3669 matching lines @@
       }
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         // TODO(verwaest): We should throw an exception.
         return Just(true);
 
       case LookupIterator::DATA:
         if (it->IsReadOnly()) {
           return WriteToReadOnlyProperty(it, value, should_throw);
         }
         if (it->HolderIsReceiverOrHiddenPrototype()) {
-          return SetDataProperty(it, value, should_throw);
+          return SetDataProperty(it, value);
         }
         done = true;
         break;
 
       case LookupIterator::TRANSITION:
         done = true;
         break;
     }
 
     if (done) break;
@@ skipping 58 matching lines @@
                                                             should_throw);
         }
         break;
 
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         return RedefineIncompatibleProperty(it->isolate(), it->GetName(), value,
                                             should_throw);
 
       case LookupIterator::DATA: {
         PropertyDetails details = own_lookup.property_details();
-        if (details.IsConfigurable() || !details.IsReadOnly()) {
-          return JSObject::DefineOwnPropertyIgnoreAttributes(
-              &own_lookup, value, details.attributes(), should_throw);
+        if (details.IsReadOnly()) {
+          return WriteToReadOnlyProperty(&own_lookup, value, should_throw);
         }
-        return WriteToReadOnlyProperty(&own_lookup, value, should_throw);
+        return SetDataProperty(&own_lookup, value);
       }
 
       case LookupIterator::ACCESSOR: {
         return RedefineIncompatibleProperty(it->isolate(), it->GetName(), value,
                                             should_throw);
       }
 
       case LookupIterator::INTERCEPTOR:
       case LookupIterator::JSPROXY: {
         bool found = false;
@@ skipping 72 matching lines @@
 
 Maybe<bool> Object::RedefineIncompatibleProperty(Isolate* isolate,
                                                  Handle<Object> name,
                                                  Handle<Object> value,
                                                  ShouldThrow should_throw) {
   RETURN_FAILURE(isolate, should_throw,
                  NewTypeError(MessageTemplate::kRedefineDisallowed, name));
 }
 
 
-Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value,
-                                    ShouldThrow should_throw) {
+Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
   // Proxies are handled on the WithHandler path. Other non-JSObjects cannot
   // have own properties.
   Handle<JSObject> receiver = Handle<JSObject>::cast(it->GetReceiver());
 
   // Store on the holder which may be hidden behind the receiver.
   DCHECK(it->HolderIsReceiverOrHiddenPrototype());
 
   // Old value for the observation change record.
   // Fetch before transforming the object since the encoding may become
   // incompatible with what's cached in |it|.
@@ skipping 970 matching lines @@
       }
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         return RedefineIncompatibleProperty(it->isolate(), it->GetName(), value,
                                             should_throw);
 
       case LookupIterator::DATA: {
         PropertyDetails details = it->property_details();
         Handle<Object> old_value = it->factory()->the_hole_value();
         // Regular property update if the attributes match.
         if (details.attributes() == attributes) {
-          return SetDataProperty(it, value, should_throw);
+          return SetDataProperty(it, value);
         }
 
         // Special case: properties of typed arrays cannot be reconfigured to
         // non-writable nor to non-enumerable.
         if (it->IsElement() && object->HasFixedTypedArrayElements()) {
           return RedefineIncompatibleProperty(it->isolate(), it->GetName(),
                                               value, should_throw);
         }
 
         // Reconfigure the data property if the attributes mismatch.
@@ skipping 13140 matching lines @@
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 
 }  // namespace internal
 }  // namespace v8