super.prop assignment can silently overwrite non-writable properties

[Allen Wirfs-Brock]

On Apr 20, 2015, at 9:38 AM, Jason Orendorff wrote:

> We're implementing `super` in Firefox, and ran across this surprising behavior:
> 
>    class X {
>        constructor() {
>            Object.defineProperty(this, "prop", {
>                configurable: true,
>                writable: false,
>                value: 1});
>        }
>        f() {
>            super.prop = 2;  // overwrites non-writable property!
>        }
>    }
> 
>    var x = new X();
>    x.f();
>    assertEq(x.prop, 2);  // passes
> 
> In the spec, 9.1.9 step 4.d.i. is where `super.prop = 2` ends up, with
> O=X.prototype.

4.d.1 doesn't set the property, it just comes up with the property descriptor to use, if the `Receiver` does not already have a corresponding own property.

5.c+5.e checks if the corresponding own property actually exists on the `Receiver`.  If it already exits then it does a [[DefineOwnProperty]] that only specifies the `value` attribute. This should respect the current `writable` attribute of the property and hence reject the attempt to change the value.

So, sounds like a FF bug to me.  Of course, there might also be a problem in the spec. that I'm blind to.

Allen