Fix another corner-case behavior of Object::SetSuperProperty.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 7422aec4e6603ddbbf52a3295a9fea13e8da9b6b..99d459ad11624eb73cf0f0a998f83d8f49dca920 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3687,7 +3687,7 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
           return WriteToReadOnlyProperty(it, value, should_throw);
         }
         if (it->HolderIsReceiverOrHiddenPrototype()) {
-          return SetDataProperty(it, value, should_throw);
+          return SetDataProperty(it, value);
         }
         done = true;
         break;
@@ -3766,11 +3766,10 @@ Maybe<bool> Object::SetSuperProperty(LookupIterator* it, Handle<Object> value,
 
       case LookupIterator::DATA: {
         PropertyDetails details = own_lookup.property_details();
-        if (details.IsConfigurable() || !details.IsReadOnly()) {
-          return JSObject::DefineOwnPropertyIgnoreAttributes(
-              &own_lookup, value, details.attributes(), should_throw);
+        if (details.IsReadOnly()) {
+          return WriteToReadOnlyProperty(&own_lookup, value, should_throw);
         }
-        return WriteToReadOnlyProperty(&own_lookup, value, should_throw);
+        return SetDataProperty(&own_lookup, value);
       }
 
       case LookupIterator::ACCESSOR: {
@@ -3863,8 +3862,7 @@ Maybe<bool> Object::RedefineIncompatibleProperty(Isolate* isolate,
 }
 
 
-Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value,
-                                    ShouldThrow should_throw) {
+Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
   // Proxies are handled on the WithHandler path. Other non-JSObjects cannot
   // have own properties.
   Handle<JSObject> receiver = Handle<JSObject>::cast(it->GetReceiver());
@@ -4855,7 +4853,7 @@ Maybe<bool> JSObject::DefineOwnPropertyIgnoreAttributes(
         Handle<Object> old_value = it->factory()->the_hole_value();
         // Regular property update if the attributes match.
         if (details.attributes() == attributes) {
-          return SetDataProperty(it, value, should_throw);
+          return SetDataProperty(it, value);
         }
 
         // Special case: properties of typed arrays cannot be reconfigured to