[defer-import-eval] Fix super property access on module namespace objects

Object::SetSuperProperty was short-circuiting to TypeError when the OWN
lookup on the receiver hit MODULE_NAMESPACE, skipping the
[[GetOwnProperty]] call that OrdinarySetWithOwnDescriptor[1] requires per
spec (step 2.c). This meant deferred module evaluation was not triggered
and TDZ bindings incorrectly threw TypeError instead of ReferenceError.

The fix replaces the MODULE_NAMESPACE case with a GetOwnPropertyDescriptor
call that mirrors the existing INTERCEPTOR/JSPROXY path. This properly
invokes the namespace's [[GetOwnProperty]], which:
- Triggers deferred module evaluation for non-symbol-like string keys
- Throws ReferenceError for uninitialized (TDZ) bindings
- Returns a writable descriptor for initialized exports, falling through
  to DefineOwnProperty which rejects the value change (TypeError)

Also marks two test262 tests as FAIL (ignore-super-property-set-exported
and ignore-super-property-set-not-exported) whose expectations are
incorrect per tc39/test262#4999.

For a detailed flow on how spec flows to thse cases, see:
tc39/test262#4980

[1] - https://tc39.es/ecma262/#sec-ordinarysetwithowndescriptor

Author: caiolima

src/objects/objects.cc

@@ -2657,9 +2657,37 @@ Maybe<bool> Object::SetSuperProperty(LookupIterator* it,
                        NewTypeError(MessageTemplate::kWasmObjectsAreOpaque));
 
       case LookupIterator::MODULE_NAMESPACE: {
-        RETURN_FAILURE(isolate, GetShouldThrow(isolate, should_throw),
-                       NewTypeError(MessageTemplate::kStrictCannotSetProperty,
-                                    it->GetName(), it->GetReceiver()));
+        PropertyDescriptor desc;
+        Maybe<bool> owned =
+            JSReceiver::GetOwnPropertyDescriptor(&own_lookup, &desc);
+        MAYBE_RETURN(owned, Nothing<bool>());
+        if (!owned.FromJust()) {
+          // Property not found on namespace (non-exported key).
+          // Spec: OrdinarySetWithOwnDescriptor step 2.d.ii calls
+          // CreateDataProperty(Receiver, P, V), which invokes
+          // Receiver.[[DefineOwnProperty]] ->
+          // JSModuleNamespace::DefineOwnProperty
+          // -> throws kRedefineDisallowed TypeError.
+          // We shortcut to RedefineIncompatibleProperty for the same result.
+          return RedefineIncompatibleProperty(isolate, it->GetName(), value,
+                                              should_throw);
+        }
+        if (PropertyDescriptor::IsAccessorDescriptor(&desc) ||
+            !desc.writable()) {
+          return RedefineIncompatibleProperty(isolate, it->GetName(), value,
+                                              should_throw);
+        }
+        // Module namespace [[GetOwnProperty]] returns writable: true for
+        // initialized exports. So this DefineOwnProperty path is reached for
+        // normal exports. DefineOwnProperty dispatches to
+        // JSModuleNamespace::DefineOwnProperty which validates that the
+        // new value equals the current value (non-configurable property
+        // constraint) and throws TypeError (kRedefineDisallowed) when it
+        // doesn't match.
+        PropertyDescriptor value_desc;
+        value_desc.set_value(Cast<JSAny>(value));
+        return JSReceiver::DefineOwnProperty(isolate, receiver, it->GetName(),
+                                             &value_desc, should_throw);
       }
 
       case LookupIterator::TRANSITION:

test/mjsunit/harmony/modules-import-defer-no-trigger.mjs

@@ -40,14 +40,33 @@ assertEquals(0, globalThis.eval_list.length);
 assertThrows(() => obj.nonExistent = 41, TypeError);
 assertEquals(0, globalThis.eval_list.length);
 
-class A { constructor() { return ns; } };
-class B extends A {
+// super property set with symbol-like keys should not trigger evaluation.
+class A { constructor() { return ns; } }
+
+class B1 extends A {
+  constructor() {
+    super();
+    super[Symbol()] = 14;
+  }
+}
+try { new B1(); } catch (_) {}
+assertEquals(0, globalThis.eval_list.length);
+
+class B2 extends A {
   constructor() {
     super();
-    super.x = 14;
+    super[Symbol.toStringTag] = 14;
   }
-};
+}
+try { new B2(); } catch (_) {}
+assertEquals(0, globalThis.eval_list.length);
 
-assertThrows(() => new B(), TypeError);
+class B3 extends A {
+  constructor() {
+    super();
+    super.then = 14;
+  }
+}
+try { new B3(); } catch (_) {}
 assertEquals(0, globalThis.eval_list.length);
 

test/mjsunit/harmony/modules-import-defer-super-property-set-exported.mjs

@@ -0,0 +1,25 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-defer-import-eval
+
+globalThis.eval_list = [];
+
+import defer * as ns from './modules-skip-import-defer-1.mjs';
+
+assertEquals(0, globalThis.eval_list.length);
+
+class A { constructor() { return ns; } }
+class B extends A {
+  constructor() {
+    super();
+    super.foo = 14;
+  }
+}
+
+try { new B(); } catch (_) {}
+
+// super.foo = 14 calls OrdinarySetWithOwnDescriptor which calls
+// Receiver.[[GetOwnProperty]]("foo") on the namespace, triggering evaluation.
+assertArrayEquals(['defer-1'], globalThis.eval_list);

test/mjsunit/harmony/modules-import-defer-super-property-set-not-exported.mjs

@@ -0,0 +1,25 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-defer-import-eval
+
+globalThis.eval_list = [];
+
+import defer * as ns from './modules-skip-import-defer-1.mjs';
+
+assertEquals(0, globalThis.eval_list.length);
+
+class A { constructor() { return ns; } }
+class B extends A {
+  constructor() {
+    super();
+    super.notExported = 14;
+  }
+}
+
+try { new B(); } catch (_) {}
+
+// Even for non-exported keys, [[GetOwnProperty]] calls GetModuleExportsList
+// which triggers evaluation.
+assertArrayEquals(['defer-1'], globalThis.eval_list);

test/mjsunit/modules-namespace-super-access-tdz.mjs

@@ -0,0 +1,17 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from './modules-namespace-super-access-tdz.mjs';
+
+class A { constructor() { return ns; } }
+class B extends A {
+  constructor() {
+    super();
+    super.foo = 14;
+  }
+}
+
+assertThrows(() => new B(), ReferenceError);
+
+export let foo = 42;

test/mjsunit/modules-namespace-super-property-set.mjs

@@ -0,0 +1,17 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let foo = 42;
+
+import * as ns from './modules-namespace-super-property-set.mjs';
+
+class A { constructor() { return ns; } }
+class B extends A {
+  constructor() {
+    super();
+    super.foo = 14;
+  }
+}
+
+assertThrows(() => new B(), TypeError);

test/mjsunit/modules-namespace-super-set-tdz-with-accessor.mjs

@@ -0,0 +1,23 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from './modules-namespace-super-set-tdz-with-accessor.mjs';
+
+let setterValue;
+
+class A {
+  set foo(v) { setterValue = v; }
+  constructor() { return ns; }
+}
+class B extends A {
+  constructor() {
+    super();
+    super.foo = 14;
+  }
+}
+
+new B();
+assertEquals(14, setterValue);
+
+export let foo = 42;

test/test262/test262.status

@@ -28,6 +28,12 @@
 [
 
 [ALWAYS, {
+  # tc39/test262 PR #4999: these tests have incorrect expectations.
+  # They assume super.prop = val on a deferred namespace doesn't trigger
+  # [[GetOwnProperty]], but OrdinarySetWithOwnDescriptor requires it.
+  'language/import/import-defer/evaluation-triggers/ignore-super-property-set-exported': [FAIL],
+  'language/import/import-defer/evaluation-triggers/ignore-super-property-set-not-exported': [FAIL],
+
   ###################### MISSING ES6 FEATURES #######################
 
   # https://code.google.com/p/v8/issues/detail?id=4248