Open
Description
openedon Jul 13, 2016
It looks to me like there's a couple of holes in the tests for mapped arguments, namely,
defineProperty
with both a value andwritable: false
should write the value and then break the mapping betweenarguments
and the corresponding parameterObject.freeze
should break the mapping for every parameter
For example, both of these should return true:
(function nonwritableAndValue(a) {
Object.defineProperty(arguments, '0', {writable: false, value: 1});
const postWriteCondition = arguments[0] === 1 && a === 1;
a = 2;
return postWriteCondition && arguments[0] === 1 && a === 2;
})(0);
(function freeze(a) {
Object.freeze(arguments);
a = 2;
return arguments[0] === 0 && a === 2;
})(0);
The Object.freeze case is particularly important as a potential security issue. (Firefox fails it, even though manually setting the property as nonwritable does correctly break the mapping.)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment