Modify Object.{freeze,seal,isFrozen,isSealed} to avoid the problematic "caller" method on Functions.

src/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1136 matching lines @@
       {value: obj, writable: true, enumerable: false, configurable: true});
     // TODO(v8:1530): defineProperty does not handle prototype and length.
     %FunctionSetPrototype(obj, prototype);
     obj.length = 0;
   } else {
     %Fix(obj);
   }
   ObjectDefineProperties(obj, props);
 }
 
+function GetOwnPropertyNamesForSealOrFreeze(obj) {
+  var names = ObjectGetOwnPropertyNames(obj);
+  if (IS_SPEC_FUNCTION(obj)) {

[rossberg, 2012/11/16 12:28:55]

IS_FUNCTION probably is more adequate here, since it shouldn't be a proxy.

[arv (Not doing code reviews), 2012/11/16 14:38:06]

There are more poison pills than functionObj.caller

function.arguments
arguments.caller
arguments.callee

[rossberg, 2012/11/16 15:52:46]

Yes, but this issue affects only "caller", because it is due to its special
casing in 15.3.5.4.

+    // The "caller" property on Functions is always non-writable and
+    // non-configurable, so there's no need to check it or redefine it.
+    // Thus, we skip it to avoid the strict-mode check the getter enforces.
+    names = names.filter(function(name) { return name != "caller"; });
+  }
+  return names;
+}
+
 
 // ES5 section 15.2.3.8.
 function ObjectSeal(obj) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.seal"]);
   }
   if (%IsJSProxy(obj)) {
     ProxyFix(obj);
   }
-  var names = ObjectGetOwnPropertyNames(obj);
+  var names = GetOwnPropertyNamesForSealOrFreeze(obj);
   for (var i = 0; i < names.length; i++) {
     var name = names[i];
     var desc = GetOwnProperty(obj, name);
     if (desc.isConfigurable()) {
       desc.setConfigurable(false);
       DefineOwnProperty(obj, name, desc, true);
     }
   }
   %PreventExtensions(obj);
   return obj;
 }
 
 
 // ES5 section 15.2.3.9.
 function ObjectFreeze(obj) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.freeze"]);
   }
   if (%IsJSProxy(obj)) {
     ProxyFix(obj);
   }
-  var names = ObjectGetOwnPropertyNames(obj);
+  var names = GetOwnPropertyNamesForSealOrFreeze(obj);
   for (var i = 0; i < names.length; i++) {
     var name = names[i];
     var desc = GetOwnProperty(obj, name);
     if (desc.isWritable() || desc.isConfigurable()) {
       if (IsDataDescriptor(desc)) desc.setWritable(false);
       desc.setConfigurable(false);
       DefineOwnProperty(obj, name, desc, true);
     }
   }
   %PreventExtensions(obj);
@@ skipping 15 matching lines @@
 
 
 // ES5 section 15.2.3.11
 function ObjectIsSealed(obj) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.isSealed"]);
   }
   if (%IsJSProxy(obj)) {
     return false;
   }
-  var names = ObjectGetOwnPropertyNames(obj);
+  var names = GetOwnPropertyNamesForSealOrFreeze(obj);
   for (var i = 0; i < names.length; i++) {
     var name = names[i];
     var desc = GetOwnProperty(obj, name);
     if (desc.isConfigurable()) return false;
   }
   if (!ObjectIsExtensible(obj)) {
     return true;
   }
   return false;
 }
 
 
 // ES5 section 15.2.3.12
 function ObjectIsFrozen(obj) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.isFrozen"]);
   }
   if (%IsJSProxy(obj)) {
     return false;
   }
-  var names = ObjectGetOwnPropertyNames(obj);
+  var names = GetOwnPropertyNamesForSealOrFreeze(obj);
   for (var i = 0; i < names.length; i++) {
     var name = names[i];
     var desc = GetOwnProperty(obj, name);
     if (IsDataDescriptor(desc) && desc.isWritable()) return false;
     if (desc.isConfigurable()) return false;
   }
   if (!ObjectIsExtensible(obj)) {
     return true;
   }
   return false;
@@ skipping 421 matching lines @@
 
 function SetUpFunction() {
   %CheckIsBootstrapping();
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString
   ));
 }
 
 SetUpFunction();