XS: Iterator.prototype setters create data properties with incorrect attributes

[d01c2]

Build environment: macOS 26.5.2

Moddable SDK version:

• Installed via jsvu, so there is no SDK source tree / git describe.
• Engine reports: XS 17.9.1, slot 32 bytes, ID 4 bytes

Target device: desktop (host xs)

Description
Assigning to the inherited Iterator.prototype.constructor setter creates an own data property on the receiver with writable, enumerable, and configurable all set to false.

The same behavior occurs with the inherited Iterator.prototype[Symbol.toStringTag] setter. Both properties should be created with all three attributes set to true.

Steps to Reproduce

$ xst -e 'var x = {}; Object.setPrototypeOf(x, Iterator.prototype); x.constructor = 0; print(JSON.stringify(Object.getOwnPropertyDescriptor(x, "constructor")))'
{"value":0,"writable":false,"enumerable":false,"configurable":false}

Expected behavior
The assignment creates the following own data property:

{"value":0,"writable":true,"enumerable":true,"configurable":true}

For comparison, V8 (15.3.27):

$ v8 -e 'var x = {}; Object.setPrototypeOf(x, Iterator.prototype); x.constructor = 0; print(JSON.stringify(Object.getOwnPropertyDescriptor(x, "constructor")))'
{"value":0,"writable":true,"enumerable":true,"configurable":true}

Other information
The setters for Iterator.prototype.constructor and Iterator.prototype[Symbol.toStringTag] both call SetterThatIgnoresPrototypeProperties.

When the receiver has no own property with the given key, that operation calls CreateDataPropertyOrThrow. The resulting data property must have [[Writable]], [[Enumerable]], and [[Configurable]] all set to true.

The same issue with Symbol.toStringTag can be reproduced with:

$ xst -e 'var x = {}; Object.setPrototypeOf(x, Iterator.prototype); x[Symbol.toStringTag] = 0; print(JSON.stringify(Object.getOwnPropertyDescriptor(x, Symbol.toStringTag)))'
{"value":0,"writable":false,"enumerable":false,"configurable":false}