Fixes a bug around assignment with no setter, and an inner hull breach.

Makes ES5/3 conform to the ES5 spec and throw when trying to assign
a value to an accessor property with no setter.

Toxic functions could be 'laundered' by using call, bind, or apply,
so an outer hull breach could be escalated to an inner hull breach.

I discovered the inner hull breach when I noticed that the wrong
exceptions were being thrown in ES5Rewriter; since jsUnit doesn't
provide a way to check the kind of exception, I added
   assertThrowsMsg(fn, msg)
that fails unless an exception ex is thrown and msg is a substring of
ex.message.

[felix8a, 2012-03-22 20:02:57]

lgtm other than some nit-picking

http://codereview.appspot.com/5873043/diff/2001/src/com/google/caja/es53.js
File src/com/google/caja/es53.js (right):

http://codereview.appspot.com/5873043/diff/2001/src/com/google/caja/es53.js#n...
src/com/google/caja/es53.js:725: fn.ok___ = fn;
why set ok___ to fn here?  everywhere else ok___ is 'true'

http://codereview.appspot.com/5873043/diff/2001/tests/com/google/caja/parser/...
File tests/com/google/caja/parser/quasiliteral/ES53RewriterTest.java (right):

http://codereview.appspot.com/5873043/diff/2001/tests/com/google/caja/parser/...
tests/com/google/caja/parser/quasiliteral/ES53RewriterTest.java:1828: // and no
backing property.
this comment is unclear.  what's this checking?  it seems like this test will
always succeed?

[metaweta, 2012-03-22 20:50:34]

http://codereview.appspot.com/5873043/diff/2001/src/com/google/caja/es53.js
File src/com/google/caja/es53.js (right):

http://codereview.appspot.com/5873043/diff/2001/src/com/google/caja/es53.js#n...
src/com/google/caja/es53.js:725: fn.ok___ = fn;
On 2012/03/22 20:02:58, felix8a wrote:
> why set ok___ to fn here?  everywhere else ok___ is 'true'

Oops! I deleted the line by accident and got it wrong when I put it back.  It's
not worth adding logic to check that ok___ points back at fn because for a
function to inherit ok___, the host page would have to explicitly modify the
__proto__ of the toxic function to point to a cajoled function *and* make it
available through an outer hull breach.

Either that or set ok___ on Function.prototype, which we explicitly don't do.

http://codereview.appspot.com/5873043/diff/2001/tests/com/google/caja/parser/...
File tests/com/google/caja/parser/quasiliteral/ES53RewriterTest.java (right):

http://codereview.appspot.com/5873043/diff/2001/tests/com/google/caja/parser/...
tests/com/google/caja/parser/quasiliteral/ES53RewriterTest.java:1828: // and no
backing property.
On 2012/03/22 20:02:58, felix8a wrote:
> this comment is unclear.  what's this checking?  it seems like this test will
> always succeed?

D'oh!  Fixed.

[felix8a, 2012-03-22 21:06:37]

lgtm