Change LookupForWrite to always do a full lookup and check the result.

test/mjsunit/regress/readonly1.js

Index: test/mjsunit/regress/readonly1.js
diff --git a/test/mjsunit/regress/regress-2565.js b/test/mjsunit/regress/readonly1.js
similarity index 77%
copy from test/mjsunit/regress/regress-2565.js
copy to test/mjsunit/regress/readonly1.js
index a77806a62e2209d355fce393b98797f1d20f40f8..b3ce51aca9763a032bdfa6a551d5d5cb96f324e9 100644
--- a/test/mjsunit/regress/regress-2565.js
+++ b/test/mjsunit/regress/readonly1.js
@@ -25,8 +25,39 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-Object.freeze(Object.prototype);
+function s(v) {
+  v.x = 1;
+}
+
+function c(p) {
+  var x = {};
+  x.__proto__ = p;
+  return x;

[rossberg, 2013/03/22 14:07:44]

You can simplify this to

  return {__proto__: p};

Same in other tests.

[Toon Verwaest, 2013/03/25 11:44:44]

Done.

+}
+
 var p = {};
-var o = Object.create(p);
-assertSame(p, o.__proto__);
-assertSame(p, Object.getPrototypeOf(o));
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make p go slow.
+p.y = 1;
+delete p.y;
+p.x = 5;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Make x non-writable.
+Object.defineProperty(p, "x", { writable: false });
+
+// Verify that direct setting fails.
+o3.x = 20;
+assertEquals(5, o3.x);
+
+// Verify that setting through the IC fails.

[rossberg, 2013/03/22 14:07:44]

Could you also add attempts to set it in strict mode (which should throw)?
Similarly in other tests.

[Toon Verwaest, 2013/03/25 11:44:44]

Done.

+s(o4);
+assertEquals(5, o4.x);