Add poisoned __proto__ tests (#2203)

* Add SuperProperty test

* Add SuperCall test

* Add ClassDeclaration test

* Add ClassExpression test

test/language/expressions/class/poisoned-underscore-proto.js

@@ -0,0 +1,28 @@
+// Copyright (C) 2019 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: prod-ClassExpression
+description: >
+  ClassExpression should directly set [[Prototype]] internal slot.
+info: |
+  ClassDefinitionEvaluation
+
+  [...]
+  7. Let proto be ObjectCreate(protoParent).
+
+  ObjectCreate ( proto [ , internalSlotsList ] )
+
+  [...]
+  4. Set obj.[[Prototype]] to proto.
+features: [class]
+---*/
+
+Object.defineProperty(Object.prototype, '__proto__', {
+  set: function() {
+    throw new Test262Error('should not be called');
+  },
+});
+
+var A = class extends Array {};
+
+assert.sameValue(new A(1).length, 1);

test/language/expressions/super/call-poisoned-underscore-proto.js

@@ -0,0 +1,23 @@
+// Copyright (C) 2019 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: prod-SuperCall
+description: >
+  SuperCall should directly invoke [[GetPrototypeOf]] internal method.
+info: |
+  GetSuperConstructor ( )
+
+  [...]
+  5. Let superConstructor be ! activeFunction.[[GetPrototypeOf]]().
+features: [class]
+---*/
+
+Object.defineProperty(Object.prototype, '__proto__', {
+  get: function() {
+    throw new Test262Error('should not be called');
+  },
+});
+
+class A extends Array {}
+
+assert.sameValue(new A(1).length, 1);

test/language/expressions/super/prop-poisoned-underscore-proto.js

@@ -0,0 +1,35 @@
+// Copyright (C) 2019 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: prod-SuperProperty
+description: >
+  SuperProperty should directly call [[GetPrototypeOf]] internal method.
+info: |
+  MakeSuperPropertyReference ( actualThis, propertyKey, strict )
+
+  [...]
+  3. Let baseValue be ? env.GetSuperBase().
+
+  GetSuperBase ( )
+
+  [...]
+  5. Return ? home.[[GetPrototypeOf]]().
+---*/
+
+Object.defineProperty(Object.prototype, '__proto__', {
+  get: function() {
+    throw new Test262Error('should not be called');
+  },
+});
+
+var obj = {
+  superExpression() {
+    return super['CONSTRUCTOR'.toLowerCase()];
+  },
+  superIdentifierName() {
+    return super.toString();
+  },
+};
+
+assert.sameValue(obj.superExpression(), Object);
+assert.sameValue(obj.superIdentifierName(), '[object Object]');

test/language/statements/class/poisoned-underscore-proto.js

@@ -0,0 +1,28 @@
+// Copyright (C) 2019 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: prod-ClassDeclaration
+description: >
+  ClassDeclaration should directly set [[Prototype]] internal slot.
+info: |
+  ClassDefinitionEvaluation
+
+  [...]
+  7. Let proto be ObjectCreate(protoParent).
+
+  ObjectCreate ( proto [ , internalSlotsList ] )
+
+  [...]
+  4. Set obj.[[Prototype]] to proto.
+features: [class]
+---*/
+
+Object.defineProperty(Object.prototype, '__proto__', {
+  set: function() {
+    throw new Test262Error('should not be called');
+  },
+});
+
+class A extends Array {}
+
+assert.sameValue(new A(1).length, 1);