Remove one more case behind --es5_readonly flag.

Plus add a couple of assertions.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10535011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -4684,6 +4684,7 @@ HInstruction* HGraphBuilder::BuildStoreNamedField(HValue* object,
     } else {
       // Otherwise, find the top prototype.
       while (proto->GetPrototype()->IsJSObject()) proto = proto->GetPrototype();
+      ASSERT(proto->GetPrototype()->IsNull());
     }
     ASSERT(proto->IsJSObject());
     AddInstruction(new(zone()) HCheckPrototypeMaps(

src/objects.cc

@@ -2117,6 +2117,7 @@ MaybeObject* JSObject::SetPropertyViaPrototypes(
         break;
       }
       case CALLBACKS: {
+        if (!FLAG_es5_readonly && result.IsReadOnly()) break;
         *done = true;
         return SetPropertyWithCallback(result.GetCallbackObject(),
             name, value, result.holder(), strict_mode);
@@ -2550,6 +2551,7 @@ void JSObject::LookupRealNamedPropertyInPrototypes(String* name,
       return result->HandlerResult(JSProxy::cast(pt));
     }
     JSObject::cast(pt)->LocalLookupRealNamedProperty(name, result);
+    ASSERT(!(result->IsProperty() && result->type() == INTERCEPTOR));
     if (result->IsProperty()) return;
   }
   result->NotFound();

test/cctest/test-api.cc

@@ -10260,6 +10260,7 @@ static v8::Handle<Value> ChildGetter(Local<String> name,
 
 
 THREADED_TEST(Overriding) {
+  i::FLAG_es5_readonly = true;
   v8::HandleScope scope;
   LocalContext context;
 

test/mjsunit/with-readonly.js

@@ -27,6 +27,8 @@
 
 // Test that readonly variables are treated correctly.
 
+// Flags: --es5_readonly
+
 // Create an object with a read-only length property in the prototype
 // chain by putting the string split function in the prototype chain.
 var o = {};