From 42c7b83ce8dded5e3ae03142736dcf8306a2c2a8 Mon Sep 17 00:00:00 2001
From: XmiliaH <xmilia.hermit@gmail.com>
Date: Wed, 21 Apr 2021 00:07:40 +0200
Subject: [PATCH] Frozen object tries to create property on receiver

---
 lib/contextify.js | 26 +++++++++++++++++++-------
 test/vm.js        |  3 +++
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/contextify.js b/lib/contextify.js
index 27a7f44..76379b4 100644
--- a/lib/contextify.js
+++ b/lib/contextify.js
@@ -44,13 +44,25 @@ const DEBUG = false;
 const OPNA = 'Operation not allowed on contextified object.';
 const captureStackTrace = Error.captureStackTrace;
 
-const FROZEN_TRAPS = host.Object.create(null);
-FROZEN_TRAPS.set = (target, key) => false;
-FROZEN_TRAPS.setPrototypeOf = (target, key) => false;
-FROZEN_TRAPS.defineProperty = (target, key) => false;
-FROZEN_TRAPS.deleteProperty = (target, key) => false;
-FROZEN_TRAPS.isExtensible = (target, key) => false;
-FROZEN_TRAPS.preventExtensions = (target) => false;
+const RETURN_FALSE = () => false;
+
+const FROZEN_TRAPS = {
+	__proto__: null,
+	set(target, key, value, receiver) {
+		return local.Reflect.defineProperty(receiver, key, {
+			__proto__: null,
+			value: value,
+			writable: true,
+			enumerable: true,
+			configurable: true
+		});
+	},
+	setPrototypeOf: RETURN_FALSE,
+	defineProperty: RETURN_FALSE,
+	deleteProperty: RETURN_FALSE,
+	isExtensible: RETURN_FALSE,
+	preventExtensions: RETURN_FALSE
+};
 
 // Map of contextified objects to original objects
 const Contextified = new host.WeakMap();
diff --git a/test/vm.js b/test/vm.js
index b890b8d..62683ba 100644
--- a/test/vm.js
+++ b/test/vm.js
@@ -995,6 +995,9 @@ describe('freeze, protect', () => {
 
 		vm.run('x.c.d = () => { return `---` };');
 		assert.strictEqual(x.c.d(), 'd');
+
+		// Extension of frozen objects should be writeable.
+		assert.strictEqual(vm.run('y = Object.create(x); y.f = 1; y.f'), 1);
 	});
 
 	it('without protect', () => {