[accessors] handle `writable` changing during ArrayLengthSetter

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 7c6d344ec0b9f1b86e8fd251f109eee6ae7a6d85..7c5305b33bb37d23dabc9ea8065ce2061be08e7a 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -167,16 +167,39 @@ void Accessors::ArrayLengthSetter(
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
   HandleScope scope(isolate);
 
+  DCHECK(Utils::OpenHandle(*name)->SameValue(isolate->heap()->length_string()));
+
   Handle<JSReceiver> object = Utils::OpenHandle(*info.Holder());
   Handle<JSArray> array = Handle<JSArray>::cast(object);
   Handle<Object> length_obj = Utils::OpenHandle(*val);
 
+  bool was_readonly = JSArray::HasReadOnlyLength(array);
+
   uint32_t length = 0;
   if (!JSArray::AnythingToArrayLength(isolate, length_obj, &length)) {
     isolate->OptionalRescheduleException(false);
     return;
   }
 
+  if (!was_readonly && length != array->length()->Number()) {
+    // AnythingToArrayLength() may have called setter re-entrantly and modified
+    // its property descriptor. Don't perform this check if "length" was
+    // previously readonly, as this may have been called during
+    // DefineOwnPropertyIgnoreAttributes().

[Toon Verwaest, 2016/11/30 18:05:52]

What about if (!was_readonly && V8_UNLIKELY(is read-only && length !=...)) ?

[caitp, 2016/11/30 18:13:36]

`I think the combination of !was_readonly && length != current_length` is the
most common case, but in that common case, the "is read only" becomes very
uncommon

+    if (V8_UNLIKELY(JSArray::HasReadOnlyLength(array))) {
+      if (info.ShouldThrowOnError()) {
+        Factory* factory = isolate->factory();
+        isolate->Throw(*factory->NewTypeError(
+            MessageTemplate::kStrictReadOnlyProperty, Utils::OpenHandle(*name),
+            i::Object::TypeOf(isolate, object), object));
+        isolate->OptionalRescheduleException(false);
+      } else {
+        info.GetReturnValue().Set(false);
+      }
+      return;
+    }
+  }
+
   JSArray::SetLength(array, length);
 
   uint32_t actual_new_len = 0;