After assignment return right hand side value instead of undefined

when Object.isExtensible(o) === false

Added corresponding tests

ES5 description: http://es5.github.com/#x11.13.1

Related issue: http://code.google.com/p/v8/issues/detail?id=1901

Contributed by ioseb.dzmanashvili@gmail.com

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9429002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -1756,7 +1756,7 @@ MaybeObject* JSObject::AddProperty(String* name,
   Heap* heap = GetHeap();
   if (!map_of_this->is_extensible()) {
     if (strict_mode == kNonStrictMode) {
-      return heap->undefined_value();
+      return value;
     } else {
       Handle<Object> args[1] = {Handle<String>(name)};
       return heap->isolate()->Throw(

test/mjsunit/object-prevent-extensions.js

@@ -114,3 +114,15 @@ Object.preventExtensions(foo);
 
 foo.x = 29;
 assertEquals(undefined, foo.x);
+
+// when Object.isExtensible(o) === false
+// assignment should return right hand side value
+var o = Object.preventExtensions({});
+var v = o.v = 50;
+assertEquals(undefined, o.v);
+assertEquals(50, v);
+
+// test same behavior as above, but for integer properties
+var n = o[0] = 100;
+assertEquals(undefined, o[0]);
+assertEquals(100, n);