From 957405f7a163913df13dd3b183d4d3513386a433 Mon Sep 17 00:00:00 2001
From: "Mark S. Miller" <erights@gmail.com>
Date: Fri, 17 Jun 2022 17:55:17 -0700
Subject: [PATCH 1/2] fix: tolerate empty func.prototype

---
 packages/ses/src/whitelist-intrinsics.js          |  9 +++++++++
 .../ses/test/test-tolerate-empty-prototype.js     | 15 +++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 packages/ses/test/test-tolerate-empty-prototype.js

diff --git a/packages/ses/src/whitelist-intrinsics.js b/packages/ses/src/whitelist-intrinsics.js
index 1819e803cd..4410d2793f 100644
--- a/packages/ses/src/whitelist-intrinsics.js
+++ b/packages/ses/src/whitelist-intrinsics.js
@@ -285,6 +285,15 @@ export default function whitelistIntrinsics(
           delete obj[prop];
         } catch (err) {
           if (prop in obj) {
+            if (typeof obj === 'function' && prop === 'prototype') {
+              obj.prototype = undefined;
+              if (obj.prototype === undefined) {
+                // eslint-disable-next-line @endo/no-polymorphic-call
+                console.warn(`Tolerating undeletable ${subPath} === undefined`);
+                // eslint-disable-next-line no-continue
+                continue;
+              }
+            }
             // eslint-disable-next-line @endo/no-polymorphic-call
             console.error(`failed to delete ${subPath}`, err);
           } else {
diff --git a/packages/ses/test/test-tolerate-empty-prototype.js b/packages/ses/test/test-tolerate-empty-prototype.js
new file mode 100644
index 0000000000..10bf655d1d
--- /dev/null
+++ b/packages/ses/test/test-tolerate-empty-prototype.js
@@ -0,0 +1,15 @@
+import test from 'ava';
+import '../index.js';
+
+// See https://github.com/zloirock/core-js/issues/1092
+const originalPush = Array.prototype.push;
+// eslint-disable-next-line no-extend-native
+Array.prototype.push = function push(...args) {
+  return Reflect.apply(originalPush, this, args);
+};
+
+lockdown();
+
+test('tolerate empty prototype', t => {
+  t.assert('prototype' in Array.prototype.push);
+});

From a1a133061c16cc47a1d813d5de87ed64472cd89b Mon Sep 17 00:00:00 2001
From: "Mark S. Miller" <erights@gmail.com>
Date: Fri, 17 Jun 2022 18:11:23 -0700
Subject: [PATCH 2/2] fix: better tests

---
 packages/ses/test/test-tolerate-empty-prototype.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/packages/ses/test/test-tolerate-empty-prototype.js b/packages/ses/test/test-tolerate-empty-prototype.js
index 10bf655d1d..7503c797db 100644
--- a/packages/ses/test/test-tolerate-empty-prototype.js
+++ b/packages/ses/test/test-tolerate-empty-prototype.js
@@ -12,4 +12,14 @@ lockdown();
 
 test('tolerate empty prototype', t => {
   t.assert('prototype' in Array.prototype.push);
+  t.is(Array.prototype.push.prototype, undefined);
+  t.deepEqual(
+    Object.getOwnPropertyDescriptor(Array.prototype.push, 'prototype'),
+    {
+      value: undefined,
+      writable: false,
+      enumerable: false,
+      configurable: false,
+    },
+  );
 });