Ensure CreateDataProperty works correctly on TypedArrays

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 7e3a325a6df6c337b5a8b0fc604f8204ff09ce5e..3956383e04723af2b5ed8e90e500a3b30e34df81 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6688,7 +6688,8 @@ Maybe<bool> JSObject::CreateDataProperty(LookupIterator* it,
   Isolate* isolate = receiver->GetIsolate();
 
   if (it->IsFound()) {
-    if (!it->IsConfigurable()) {
+    if (it->state() == LookupIterator::INTEGER_INDEXED_EXOTIC ||

[adamk, 2016/03/21 21:44:01]

Why is this needed? DefineOwnPropertyIgnoreAttributes looks like it already
handles this state, and calls RedefineIncompatibleProperty(), which throws the
same TypeError.

[Dan Ehrenberg, 2016/03/21 22:08:43]

If there isn't a check here, then IsConfigurable() throws because
INTEGER_INDEXED_EXOTIC doesn't have property_details_.

[Toon Verwaest, 2016/03/31 15:08:03]

IsConfigurable should not be exposed at all. You need to call
GetPropertyAttributes(it) in case of IsFound() to get to the actual attributes.
The cached property_details_ are only valid for data properties on the object;
not for INTERCEPTOR, ACCESS_CHECK, INTEGER_INDEXED_EXOTIC. For INTEGER_INDEXED
this will claim ABSENT, but that's fine since DefineOwnPropertyIgnoreAttributes
throws the correct error as Adam mentioned.

[Dan Ehrenberg, 2016/04/04 23:48:06]

I guess all of those cases could actually come up in concat, as a species
constructor can return anything. What do you think of the new patch?

+        !it->IsConfigurable()) {
       RETURN_FAILURE(
           isolate, should_throw,
           NewTypeError(MessageTemplate::kRedefineDisallowed, it->GetName()));