Fix the behavior of 'super.foo' assignment when receiver is not an object.

R=arv@chromium.org,verwaest@chromium.org
BUG=v8:4097
LOG=N

Review URL: https://codereview.chromium.org/1132203005

Cr-Commit-Position: refs/heads/master@{#28377}

src/objects.cc

@@ -3279,6 +3279,11 @@ MaybeHandle<Object> Object::SetSuperProperty(LookupIterator* it,
       SetPropertyInternal(it, value, language_mode, store_mode, &found);
   if (found) return result;
 
+  if (!it->GetReceiver()->IsJSReceiver()) {
+    return WriteToReadOnlyProperty(it->isolate(), it->GetReceiver(), it->name(),
+                                   value, language_mode);
+  }
+
   LookupIterator own_lookup(it->GetReceiver(), it->name(), LookupIterator::OWN);
 
   switch (own_lookup.state()) {

test/mjsunit/es6/regress/regress-4097.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function StoreToSuper () {
+ "use strict";
+ class A {
+   s() {
+        super.bla = 10;
+   }
+ };
+
+ let a = new A();
+ (new A).s.call(a);
+ assertEquals(10, a.bla);
+ assertThrows(function() { (new A).s.call(undefined); }, TypeError);
+ assertThrows(function() { (new A).s.call(42); }, TypeError);
+ assertThrows(function() { (new A).s.call(null); }, TypeError);
+ assertThrows(function() { (new A).s.call("abc"); }, TypeError);
+})();
+
+
+(function LoadFromSuper () {
+ "use strict";
+ class A {
+   s() {
+        return super.bla;
+   }
+ };
+
+ let a = new A();
+ assertSame(undefined, (new A).s.call(a));
+ assertSame(undefined, (new A).s.call(undefined));
+ assertSame(undefined, (new A).s.call(42));
+ assertSame(undefined, (new A).s.call(null));
+ assertSame(undefined, (new A).s.call("abc"));
+})();