Fix corner-case behavior of Object::SetSuperProperty.

Fix corner-case behavior of Object::SetSuperProperty.

When the property is an accessor property in the receiver but not on the
holder (ES6 "target"), we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Committed: https://crrev.com/8c1377a5b4ef3b88610d638ae989072a154e8b90
Cr-Commit-Position: refs/heads/master@{#31733}

[rossberg, 2015-10-30 14:26:48]

lgtm

[Toon Verwaest, 2015-11-02 09:28:02]

https://codereview.chromium.org/1427113002/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1427113002/diff/1/src/objects.cc#newcode3769
src/objects.cc:3769: if (details.IsConfigurable() || !details.IsReadOnly()) {
step 5.e.ii of 9.1.9 says "If existingDescriptor.[[Writable]] is false, return
false.", so I guess we need to remove the details.IsConfigurable() || part of
this branch.

[neis, 2015-11-03 07:45:26]

The CQ bit was checked by neis@chromium.org

[neis, 2015-11-03 07:45:26]

The patchset sent to the CQ was uploaded after l-g-t-m from
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/1427113002/#ps20001
(title: "Rebase")

[commit-bot: I haz the power, 2015-11-03 07:45:31]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1427113002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1427113002/20001

[commit-bot: I haz the power, 2015-11-03 08:04:06]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-11-03 08:04:48]

Patchset 2 (id:??) landed as
https://crrev.com/8c1377a5b4ef3b88610d638ae989072a154e8b90
Cr-Commit-Position: refs/heads/master@{#31733}