SetProperty doesn't handle the case where the receiver object has a non-writable property

When checking for non-writable properties while trying to set a property, we only check the object. If the receiver has a non-writable property we should throw in strict mode.

Fixes: #5948

Author: boingoing

lib/Runtime/Language/JavascriptOperators.cpp

@@ -2697,8 +2697,19 @@ using namespace Js;
         *result = FALSE;
         Var setterValueOrProxy = nullptr;
         DescriptorFlags flags = None;
+        bool receiverNonWritable = false;
+
+        if (receiver != object && !isRoot)
+        {
+            Var receiverSetter = nullptr;
+            PropertyValueInfo receiverInfo;
+            DescriptorFlags receiverFlags = VarTo<RecyclableObject>(receiver)->GetSetter(propertyId, &receiverSetter, &receiverInfo, requestContext);
+            receiverNonWritable = ((receiverFlags & Data) == Data && (receiverFlags & Writable) == None);
+        }
+
         if ((isRoot && JavascriptOperators::CheckPrototypesForAccessorOrNonWritableRootProperty(object, propertyId, &setterValueOrProxy, &flags, info, requestContext)) ||
-            (!isRoot && JavascriptOperators::CheckPrototypesForAccessorOrNonWritableProperty(object, propertyId, &setterValueOrProxy, &flags, info, requestContext)))
+            (!isRoot && JavascriptOperators::CheckPrototypesForAccessorOrNonWritableProperty(object, propertyId, &setterValueOrProxy, &flags, info, requestContext) ||
+            receiverNonWritable))
         {
             if ((flags & Accessor) == Accessor)
             {
@@ -2746,7 +2757,7 @@ using namespace Js;
             }
             else
             {
-                Assert((flags & Data) == Data && (flags & Writable) == None);
+                Assert(((flags & Data) == Data && (flags & Writable) == None) || receiverNonWritable);
                 if (!allowUndecInConsoleScope)
                 {
                     if (flags & Const)

test/es6/ES6Super.js

@@ -48,14 +48,18 @@ var tests = [
         "use strict";
         var obj0 = {
             m() {
+                assert.areEqual(this, obj0);
+                assert.areEqual(this.__proto__, base, "this.__proto__ === base");
                 super.prop = "identifier";
-                Object.freeze(obj0);
+                assert.isTrue(this.hasOwnProperty('prop'), "this.hasOwnProperty('prop')");
+                Object.freeze(this);
                 super.prop = "super";
             }
         };
 
         var obj1 = {
             m() {
+                assert.areEqual(this, obj1);
                 super['prop'] = "expression";
                 Object.freeze(obj1);
                 super['prop'] = "super";

test/es6/super_bugs.js

@@ -77,6 +77,120 @@ var tests = [
            assert.areEqual("Base", new Derived().test());
        }
     },
+    {
+       name: "Class member trying to write to non-writable property of receiver object via super-dot-assignment throws",
+       body: function ()
+       {
+           class Base {}
+           class Derived extends Base {
+               test() {
+                   assert.areEqual(this, obj, 'this === obj');
+
+                   super.prop = 'something';
+               }
+           }
+
+           var obj = new Derived();
+           Object.defineProperty(obj, 'prop', { writable:false, value:'nothing' });
+           assert.throws(()=>obj.test(), TypeError, 'Class methods are strict mode code. Cannot write to non-writable properties.', 'Assignment to read-only properties is not allowed in strict mode');
+           assert.areEqual('nothing', obj.prop);
+       }
+    },
+    {
+       name: "Class member trying to write to writable property of receiver object via super-dot-assignment is fine",
+       body: function ()
+       {
+           class Base {}
+           class Derived extends Base {
+               test() {
+                   assert.areEqual(this, obj, 'this === obj');
+
+                   super.prop = 'something';
+               }
+           }
+
+           var obj = new Derived();
+           Object.defineProperty(obj, 'prop', { writable:true, value:'nothing' });
+           obj.test();
+           assert.isTrue(obj.hasOwnProperty('prop'));
+           assert.areEqual('something', obj.prop);
+       }
+    },
+    {
+       name: "Function writing to non-writable property of receiver object via super-dot-assignment throws in strict mode",
+       body: function ()
+       {
+           function ctor() { }
+           ctor.prototype = {
+               test() {
+                   'use strict';
+                   super.prop = 'something';
+               }
+           };
+
+           var obj = new ctor();
+           Object.defineProperty(obj, 'prop', { writable:false, value:'nothing' });
+           assert.throws(()=>obj.test(), TypeError, 'Strict mode code throws if we try to write to non-writable properties.', 'Assignment to read-only properties is not allowed in strict mode');
+           assert.areEqual('nothing', obj.prop);
+       }
+    },
+    {
+       name: "Function writing to non-writable property of receiver object via super-dot-assignment silently fails in sloppy mode",
+       body: function ()
+       {
+           function ctor() { }
+           ctor.prototype = {
+               test() {
+                   super.prop = 'something';
+               }
+           };
+
+           var obj = new ctor();
+           Object.defineProperty(obj, 'prop', { writable:false, value:'nothing' });
+           obj.test();
+           assert.areEqual('nothing', obj.prop);
+       }
+    },
+    {
+       name: "Writing property to receiver via super-dot-assignment when receiver prototype-chain contains non-writable property doesn't throw",
+       body: function ()
+       {
+           function ctor() { }
+           ctor.prototype = {
+               test() {
+                   'use strict';
+                   super.prop = 'something';
+               }
+           };
+
+           var obj = new ctor();
+           Object.defineProperty(obj.__proto__, 'prop', { writable:false, value:'nothing' });
+           obj.test();
+           assert.isTrue(obj.hasOwnProperty('prop'));
+           assert.areEqual('something', obj.prop);
+           assert.areEqual('nothing', obj.__proto__.prop);
+       }
+    },
+    {
+       name: "Writing property to receiver via super-dot-assignment when receiver prototype-chain contains getter but no setter doesn't throw",
+       body: function ()
+       {
+           function ctor() { }
+           ctor.prototype = {
+               test() {
+                   'use strict';
+                   super.prop = 'something';
+               }
+           };
+
+           var obj = new ctor();
+           Object.defineProperty(obj.__proto__, 'prop', { get:()=>'nothing' });
+           obj.test();
+           assert.isTrue(obj.hasOwnProperty('prop'));
+           assert.areEqual('something', obj.prop);
+           assert.areEqual('nothing', obj.__proto__.prop);
+       }
+    },
 ];
 
 testRunner.runTests(tests, { verbose: WScript.Arguments[0] != "summary" });