[es6] throw TypeError when setting cyclic prototype value

Object.setPrototypeOf() throws a TypeError if value would create a
cycle. Previously a plain Error was thrown rather than a TypeError.

BUG=v8:4197
R=mike@bocoup.com
LOG=N

Review URL: https://codereview.chromium.org/1198523002

Cr-Commit-Position: refs/heads/master@{#29169}

src/objects.cc

@@ -12381,7 +12381,8 @@ MaybeHandle<Object> JSObject::SetPrototype(Handle<JSObject> object,
        !iter.IsAtEnd(); iter.Advance()) {
     if (JSReceiver::cast(iter.GetCurrent()) == *object) {
       // Cycle detected.
-      THROW_NEW_ERROR(isolate, NewError(MessageTemplate::kCyclicProto), Object);
+      THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kCyclicProto),
+                      Object);
     }
   }
 

test/mjsunit/harmony/set-prototype-of.js

@@ -139,6 +139,24 @@ function TestSetPrototypeOfNonExtensibleObject() {
 TestSetPrototypeOfNonExtensibleObject();
 
 
+function TestSetPrototypeCyclic() {
+  var objects = [
+    Object.prototype, {},
+    Array.prototype, [],
+    Error.prototype, new TypeError,
+    // etc ...
+  ];
+  for (var i = 0; i < objects.length; i += 2) {
+    var object = objects[i];
+    var value = objects[i + 1];
+    assertThrows(function() {
+      Object.setPrototypeOf(object, value);
+    }, TypeError);
+  }
+}
+TestSetPrototypeCyclic();
+
+
 function TestLookup() {
   var object = {};
   assertFalse('x' in object);

test/mjsunit/proto-accessor.js

@@ -29,6 +29,24 @@
 this.Symbol = typeof Symbol != 'undefined' ? Symbol : String;
 
 
+function TestSetProtoValueCyclic() {
+  var objects = [
+    Object.prototype, {},
+    Array.prototype, [],
+    Error.prototype, new TypeError,
+    // etc ...
+  ];
+  for (var i = 0; i < objects.length; i += 2) {
+    var object = objects[i];
+    var value = objects[i + 1];
+    assertThrows(function() {
+      object.__proto__ = value;
+    }, TypeError);
+  }
+};
+TestSetProtoValueCyclic();
+
+
 var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
 var getProto = desc.get;
 var setProto = desc.set;

test/webkit/cyclic-prototypes-expected.txt

@@ -26,7 +26,7 @@ This test makes sure we don't hang when setting cyclic prototype values: http://
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS o1.__proto__ = o3; threw exception Error: Cyclic __proto__ value.
+PASS o1.__proto__ = o3; threw exception TypeError: Cyclic __proto__ value.
 PASS ({}).hasOwnProperty.call(o1, '__proto__') is false
 PASS ({}).hasOwnProperty.call(o1, '__proto__') is true
 PASS Object.getPrototypeOf(o1) is null