[regexp] Fix writing of lastIndex in JSRegExp::Initialize.

The lastIndex property must be written with the semantics of a strict [[Set]],
so an exception must be thrown when the attributes don't allow writing.  We used
to ignore the attributes.

R=littledan@chromium.org, yangguo@chromium.org
BUG=v8:5138

Review-Url: https://codereview.chromium.org/2109593002
Cr-Commit-Position: refs/heads/master@{#37369}

src/objects.cc

@@ -16041,12 +16041,11 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
                                   Smi::FromInt(0), SKIP_WRITE_BARRIER);
   } else {
     // Map has changed, so use generic, but slower, method.
-    PropertyAttributes writable =
-        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-    JSObject::SetOwnPropertyIgnoreAttributes(
-        regexp, factory->last_index_string(),
-        Handle<Smi>(Smi::FromInt(0), isolate), writable)
-        .Check();
+    RETURN_ON_EXCEPTION(
+        isolate,
+        JSReceiver::SetProperty(regexp, factory->last_index_string(),
+                                Handle<Smi>(Smi::FromInt(0), isolate), STRICT),
+        JSRegExp);
   }
 
   return regexp;

test/mjsunit/regress/regress-349870.js

@@ -1,7 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var r = /x/;
-Object.freeze(r);
-r.compile("x");

test/test262/test262.status

@@ -465,9 +465,6 @@
   'annexB/built-ins/RegExp/prototype/compile/pattern-regexp-same': [FAIL],
   'annexB/built-ins/RegExp/prototype/compile/pattern-undefined': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5138
-  'annexB/built-ins/RegExp/prototype/compile/pattern-regexp-immutable-lastindex': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=5139
   'annexB/built-ins/Date/prototype/setYear/time-clip': [FAIL],
   'annexB/built-ins/Date/prototype/setYear/year-number-relative': [FAIL],