[[Set]] and inherited readonly data properties

[Jason Orendorff]

    "use strict";
    function Pony() {}
    Object.freeze(Object.prototype);
    Pony.prototype.toString = function () { return "Pony"; };

The last line here throws a TypeError in ES5 and ES6.*  Can we change
it? To me, it stands to reason that you should be able to freeze
Object.prototype and not break your other code, as long as that code
doesn't actually try to modify Object.prototype.

This bit some Mozilla hackers in <http://bugzil.la/980752>.

Compatibility: Changing from throwing to not-throwing is usually ok.
In addition, I don't think Chrome implements this TypeError. So
presumably the web can't be depending on the exception.

Patch: Step 5.a of [[Set]] could be changed like from:
    a. If ownDesc.[[Writable]] is false, return false.
to:
    a. If ownDesc.[[Writable]] is false and O and Receiver are the
same object, return false.

-j


*Why I think it throws:

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-ordinary-object-internal-methods-and-internal-slots-set-p-v-receiver

Pony.prototype.[[Set]] reaches step 4.c. and tail-calls
Object.prototype.[[Set]], which reaches step 5.a. and returns false.

The TypeError is thrown from step 6.d. of PutValue:
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-putvalue

which is called from step 1.f. from AssignmentExpression Evaluation:
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-assignment-operators-runtime-semantics-