[builtins] Fix error message in Proxy set trap

Bug: chromium:842101

R=neis@chromium.org

Change-Id: I4a142b28682ba73cbf3398e74c15614fa491ad40
Reviewed-on: https://chromium-review.googlesource.com/1057627
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53164}

src/builtins/builtins-proxy-gen.cc

@@ -716,14 +716,23 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
 
     BIND(&throw_non_configurable_data);
     {
-      ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableData,
-                     name, var_value.value(), trap_result);
+      if (access_kind == JSProxy::kGet) {
+        ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableData,
+                       name, var_value.value(), trap_result);
+      } else {
+        ThrowTypeError(context, MessageTemplate::kProxySetFrozenData, name);
+      }
     }
 
     BIND(&throw_non_configurable_accessor);
     {
-      ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableAccessor,
-                     name, trap_result);
+      if (access_kind == JSProxy::kGet) {
+        ThrowTypeError(context,
+                       MessageTemplate::kProxyGetNonConfigurableAccessor, name,
+                       trap_result);
+      } else {
+        ThrowTypeError(context, MessageTemplate::kProxySetFrozenAccessor, name);
+      }
     }
   }
 }

test/message/regress/fail/regress-crbug-842101.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function set_value(obj, prop) { return obj[prop] = undefined }
+
+var object1 = new Proxy({}, {set: true});
+try { set_value(object1, "bla"); } catch (_) {};
+try { set_value(object1, "0"); } catch (_) {};
+try { set_value(object1, Symbol()); } catch(_) {};
+
+set_value({}, 1073741824)
+
+var target = {};
+var handler = { set() { return 42 } };
+var object2 = new Proxy(target, handler);
+Object.defineProperty(target, 'bla', { value: 0 });
+set_value(object2, 'bla', 0);

test/message/regress/fail/regress-crbug-842101.out

+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:5: TypeError: 'set' on proxy: trap returned truish for property 'bla' which exists in the proxy target as a non-configurable and non-writable data property with a different value
+function set_value(obj, prop) { return obj[prop] = undefined }
+                                                 ^
+TypeError: 'set' on proxy: trap returned truish for property 'bla' which exists in the proxy target as a non-configurable and non-writable data property with a different value
+    at set_value (*%(basename)s:5:50)
+    at *%(basename)s:18:1