Set Error.stack property writable

Previously, the stack property was set up in JS as read-only; but since
it had a JS setter, writability was ignored and writing to stack was
possible.

This is no longer the case now that stack is either an actual data
property, or is associated with C++ accessors. Explicitly set the
property as writable to preserve old behavior.

BUG=5245
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2190313002
Cr-Commit-Position: refs/heads/master@{#38158}

src/builtins/builtins-error.cc

@@ -53,6 +53,7 @@ BUILTIN(ErrorCaptureStackTrace) {
 
   PropertyDescriptor desc;
   desc.set_configurable(true);
+  desc.set_writable(true);
   desc.set_value(formatted_stack_trace);
   Maybe<bool> status = JSReceiver::DefineOwnProperty(
       isolate, object, isolate->factory()->stack_string(), &desc,

test/mjsunit/regress/regress-5245.js

@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// After captureStackTrace.
+
+var a = {};
+Error.captureStackTrace(a, Error);
+a.stack = 1;  // Should not throw, stack should be writable.
+
+// After the standard Error constructor.
+
+var b = new Error();
+b.stack = 1;  // Should not throw, stack should be writable.
+b.stack = 1;  // Still writable.
+
+// After read access to stack.
+
+var c = new Error();
+var old_stack = c.stack;
+c.stack = 1;  // Should not throw, stack should be writable.
+c.stack = 1;  // Still writable.

test/mjsunit/stack-traces.js

@@ -386,9 +386,9 @@ var o = {};
 Error.captureStackTrace(o);
 assertEquals([], Object.keys(o));
 var desc = Object.getOwnPropertyDescriptor(o, "stack");
-assertFalse(desc.writable);
 assertFalse(desc.enumerable);
 assertTrue(desc.configurable);
+assertTrue(desc.writable);
 
 // Check that exceptions thrown within prepareStackTrace throws an exception.
 Error.prepareStackTrace = function(e, frames) { throw 42; }