Allow the global object to be frozen through the global template

src/objects.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <memory>
 #include <sstream>
@@ skipping 15530 matching lines @@
       real_receiver = PrototypeIterator::GetCurrent<JSObject>(iter);
       iter.Advance();
       all_extensible = all_extensible && real_receiver->map()->is_extensible();
     }
   }
   Handle<Map> map(real_receiver->map());
 
   // Nothing to do if prototype is already set.
   if (map->prototype() == *value) return Just(true);
 
-  bool immutable_proto = object->map()->is_immutable_proto();
+  bool immutable_proto = map->is_immutable_proto();
   if (immutable_proto) {
     RETURN_FAILURE(
         isolate, should_throw,
         NewTypeError(MessageTemplate::kImmutablePrototypeSet, object));
   }
 
   // From 8.6.2 Object Internal Methods
   // ...
   // In addition, if [[Extensible]] is false the value of the [[Class]] and
   // [[Prototype]] internal properties of the object may not be modified.
@@ skipping 4700 matching lines @@
         ns, Accessors::ModuleNamespaceEntryInfo(isolate, name, attr))
         .Check();
   }
   JSObject::PreventExtensions(ns, THROW_ON_ERROR).ToChecked();
 
   return ns;
 }
 
 }  // namespace internal
 }  // namespace v8