Implement correct checking for inherited readonliness on assignment.

test/mjsunit/regress/regress-334.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 22 matching lines @@
 var DONT_ENUM   = 2;
 var DONT_DELETE = 4;
 
 function func1(){}
 function func2(){}
 
 var object = {__proto__:{}};
 %SetProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
 %SetProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
 %SetProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
-%SetProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE | READ_ONLY);
+%SetProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE);
 object.bif = func2;
 
 function enumerable(obj) {
   var res = [];
   for (var i in obj) {
     res.push(i);
+    print(i);

[Michael Starzinger, 2012/05/30 13:08:55]

Can we remove this debugging code again.

[Michael Starzinger, 2012/06/01 08:34:04]

I think you missed that one.

[rossberg, 2012/06/01 09:42:48]

Indeed, thanks!

   }
   res.sort();
   return res;
 }
 
 // Sanity check: expected initial state.
 assertArrayEquals(["baz", "bif"], enumerable(object), "enum0");
 assertFalse(delete object.foo, "delete foo");
 assertFalse(delete object.baz, "delete baz");
 assertEquals(func1, object.foo, "read foo");
@@ skipping 21 matching lines @@
 assertArrayEquals(["bar", "baz", "bif"], enumerable(object), "enum3");
 
 // Unshadowing a prototype property exposes its attributes.
 assertTrue(delete object.bif, "delete bif");
 assertArrayEquals(["bar", "baz"], enumerable(object), "enum4");
 assertEquals(func1, object.bif, "read bif 2");
 // Can't delete prototype property.
 assertTrue(delete object.bif, "delete bif 2");
 assertArrayEquals(["bar", "baz"], enumerable(object), "enum5");
 assertEquals(func1, object.bif, "read bif3");