Missing test for mapped arguments object

[bakkot]

It looks to me like there's a couple of holes in the tests for mapped arguments, namely,

• defineProperty with both a value and writable: false should write the value and then break the mapping between arguments and the corresponding parameter
• Object.freeze should break the mapping for every parameter

For example, both of these should return true:

(function nonwritableAndValue(a) {
  Object.defineProperty(arguments, '0', {writable: false, value: 1});
  const postWriteCondition = arguments[0] === 1 && a === 1;
  a = 2;
  return postWriteCondition && arguments[0] === 1 && a === 2;
})(0);

(function freeze(a) {
  Object.freeze(arguments);
  a = 2;
  return arguments[0] === 0 && a === 2;
})(0);

The Object.freeze case is particularly important as a potential security issue. (Firefox fails it, even though manually setting the property as nonwritable does correctly break the mapping.)

[leobalter]

@bakkot can you confirm if this is solved by #815?

[leobalter]

in a quick search, I can't find any application for .freeze, so I'm assuming this is not fixed yet.