Linus Groh ac3e7ef791 LibJS: Fix crash in Object.{freeze,seal}() with indexed properties ...

This was failing to take two things into account:

- When constructing a PropertyName from a value, it won't automatically
  convert to Type::Number for something like string "0", even though
  that's how things work internally, since indexed properties are stored
  separately. This will be improved in a future patch, it's a footgun
  and should happen automatically.
- Those can't be looked up on the shape, we have to go through the
  indexed properties instead.

Additionally it now operates on the shape or indexed properties directly
as define_property() was overly strict and would throw if a property was
already non-configurable.

Fixes #6469.

2021-04-20 09:38:22 +02:00

40 KiB

Raw Blame History

View Raw