Cleanup INTEGER_INDEXED_EXOTIC handling a bit

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1191813003

Cr-Commit-Position: refs/heads/master@{#29116}

src/objects.cc

@@ -3104,8 +3104,8 @@ MaybeHandle<Object> Object::SetPropertyInternal(LookupIterator* it,
         return SetPropertyWithAccessor(it, value, language_mode);
       }
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
-        done = true;
-        break;
+        // TODO(verwaest): We should throw an exception.
+        return value;
 
       case LookupIterator::DATA:
         if (it->IsReadOnly()) {
@@ -3180,7 +3180,8 @@ MaybeHandle<Object> Object::SetSuperProperty(LookupIterator* it,
         break;
 
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
-        return result;
+        return RedefineNonconfigurableProperty(it->isolate(), it->GetName(),
+                                               value, language_mode);
 
       case LookupIterator::DATA: {
         PropertyDetails details = own_lookup.property_details();
@@ -3350,7 +3351,7 @@ MaybeHandle<Object> Object::AddDataProperty(LookupIterator* it,
     return WriteToReadOnlyProperty(it, value, language_mode);
   }
 
-  if (it->state() == LookupIterator::INTEGER_INDEXED_EXOTIC) return value;
+  DCHECK_NE(LookupIterator::INTEGER_INDEXED_EXOTIC, it->state());
 
   Handle<JSObject> receiver = it->GetStoreTarget();
 
@@ -4181,9 +4182,6 @@ MaybeHandle<Object> JSObject::DefineOwnPropertyIgnoreAttributes(
         }
         break;
 
-      case LookupIterator::INTEGER_INDEXED_EXOTIC:
-        return value;
-
       case LookupIterator::ACCESSOR: {
         Handle<Object> accessors = it->GetAccessors();
 
@@ -4236,6 +4234,10 @@ MaybeHandle<Object> JSObject::DefineOwnPropertyIgnoreAttributes(
 
         return value;
       }
+      case LookupIterator::INTEGER_INDEXED_EXOTIC:
+        return RedefineNonconfigurableProperty(it->isolate(), it->GetName(),
+                                               value, STRICT);
+
       case LookupIterator::DATA: {
         PropertyDetails details = it->property_details();
         Handle<Object> old_value = it->factory()->the_hole_value();

test/mjsunit/es6/indexed-integer-exotics.js

@@ -55,9 +55,10 @@ for (var i = 0; i < 3; i++) {
 %OptimizeFunctionOnNextCall(f);
 assertEquals(undefined, f());
 
-Object.defineProperty(new Int32Array(), "-1", {'value': 1});
-Object.defineProperty(new Int32Array(), "-0", {'value': 1});
-Object.defineProperty(new Int32Array(), "-10", {'value': 1});
-Object.defineProperty(new Int32Array(), "4294967295", {'value': 1});
+assertThrows('Object.defineProperty(new Int32Array(100), -1, {value: 1})');
+// -0 gets converted to the string "0", so use "-0" instead.
+assertThrows('Object.defineProperty(new Int32Array(100), "-0", {value: 1})');
+assertThrows('Object.defineProperty(new Int32Array(100), -10, {value: 1})');
+assertThrows('Object.defineProperty(new Int32Array(), 4294967295, {value: 1})');
 
 check();