Always check global property cells for readonliness before storing.

test/mjsunit/regress/readonly5.js

Index: test/mjsunit/regress/readonly5.js
diff --git a/test/mjsunit/regress/negative_lookup.js b/test/mjsunit/regress/readonly5.js
similarity index 77%
copy from test/mjsunit/regress/negative_lookup.js
copy to test/mjsunit/regress/readonly5.js
index e23e365fc7ca2add2c3d950157ad56269669e276..b1499ddfcfd75b3d49d7aed2719394eb8c974994 100644
--- a/test/mjsunit/regress/negative_lookup.js
+++ b/test/mjsunit/regress/readonly5.js
@@ -25,41 +25,44 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+this.__proto__ = null;
+this.x = 10;
+delete this.x;
+
 function s(v) {
-  v.x = 1;
+  return v.x = 1;
 }
 
-function c(p) {
-  return {__proto__: p};
+function s_strict(v) {
+  "use strict";
+  return v.x = 1;
 }
 
-var p = {};
-
-// Make p the last prototype in the chain.
-p.__proto__ = null;
-
-var o1 = c(p);
-var o2 = c(p);
-var o3 = c(p);
-var o4 = c(p);
+function c() {
+  var o = {__proto__:this};
+  return o;
+}
 
-// Make y go to slow mode.
-// Do this after using p as prototype, since using an object as prototype kicks
-// it back into fast mode.
-p.y = 1;
-delete p.y;
+var o1 = c();
+var o2 = c();
+var o1_strict = c();
+var o2_strict = c();
+var o3 = c();
+var o4 = c();
 
 // Initialize the store IC.
 s(o1);
 s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
 
-// Do something with x in slow-mode p.
-Object.defineProperty(p, "x", { writable: false, value: 5 });
+Object.defineProperty(this, "x", {writable:false, configurable:true});
 
 // Verify that directly setting x fails.
-o3.x = 10;
-assertEquals(5, o3.x);
+o3.x = 1;
+assertEquals(undefined, o3.x);
 
 // Verify that setting x through the IC fails.
+assertThrows("s_strict(o4)", TypeError);
 s(o4);
-assertEquals(5, o4.x);
+assertEquals(undefined, o4.x);