Open
Description
It looks to me like there's a couple of holes in the tests for mapped arguments, namely,
defineProperty
with both a value andwritable: false
should write the value and then break the mapping betweenarguments
and the corresponding parameterObject.freeze
should break the mapping for every parameter
For example, both of these should return true:
(function nonwritableAndValue(a) {
Object.defineProperty(arguments, '0', {writable: false, value: 1});
const postWriteCondition = arguments[0] === 1 && a === 1;
a = 2;
return postWriteCondition && arguments[0] === 1 && a === 2;
})(0);
(function freeze(a) {
Object.freeze(arguments);
a = 2;
return arguments[0] === 0 && a === 2;
})(0);
The Object.freeze case is particularly important as a potential security issue. (Firefox fails it, even though manually setting the property as nonwritable does correctly break the mapping.)