Chris Tateandblurname 7bce848e4d Freeze class instances held in untyped values ...

Object.freeze, Object.seal and Object.preventExtensions of a class
instance held in an untyped value threw SC2020 at run time. Node changes
the instance itself: writes through its typed references then throw the
read-only TypeError in strict mode code, adding properties through any
reference fails, and Object.isFrozen, isSealed and isExtensible report
the state through either reference.

- In a program that freezes, seals or prevents extensions of an untyped
  value that is not a fresh literal, every class hierarchy that can be held
  there gets the integrity word that static Object.freeze already uses, and
  with it the existing write checks.
- The runtime applies the operation to the instance's checked view and
  commits the view. The commit of such a hierarchy stores the view's
  integrity state in the word (scr_dyn_class_view_integrity) and makes the
  instance's property bag not extensible with it. A hierarchy without the
  word still throws SC2020.
- These commits replace and remove the bag's field entries whatever their
  attributes, so a sealed or frozen view does not leave stale field values
  in the bag.
- The analysis behind records and arrays now starts from these calls only,
  rather than from every untyped freeze the lowering emits, such as the
  frozen strings array of a tagged template.
- Programs without such calls compile as before. The runtime ABI moves to
  v38.

Corpus 7407 covers freeze, seal and preventExtensions through unknown of
classes and subclasses, writes through typed and untyped references and
through methods, properties added before and after the operation, and the
integrity queries, and matches Node.

Refs #1374

Co-authored-by: blurname <50226652+blurname@users.noreply.github.com>

2026-10-23 20:13:09 -05:00

..

docs

Add --target-cpu for x86-64 microarchitecture levels (#2025)

2026-10-23 20:00:33 -05:00

limitations

Freeze class instances held in untyped values

2026-10-23 20:13:09 -05:00