Freeze proxy from sealed elements-kind object can normalize elements

Bug: chromium:966460
Change-Id: I418eab656510fe3f799f552e75be10140d25bcab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625864Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61922}

src/objects/elements.cc

@@ -2697,6 +2697,13 @@ class FastFrozenObjectElementsAccessor
                             Handle<FixedArrayBase> backing_store) {
     UNREACHABLE();
   }
+
+  static void ReconfigureImpl(Handle<JSObject> object,
+                              Handle<FixedArrayBase> store, uint32_t entry,
+                              Handle<Object> value,
+                              PropertyAttributes attributes) {
+    UNREACHABLE();
+  }
 };
 
 class FastPackedFrozenObjectElementsAccessor

src/objects/js-objects-inl.h

@@ -822,6 +822,10 @@ bool JSObject::HasFrozenOrSealedElements() {
   return IsFrozenOrSealedElementsKind(GetElementsKind());
 }
 
+bool JSObject::HasSealedElements() {
+  return IsSealedElementsKind(GetElementsKind());
+}
+
 bool JSObject::HasFastArgumentsElements() {
   return GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
 }

src/objects/js-objects.cc

@@ -3462,7 +3462,7 @@ Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) {
 
   DCHECK(object->HasSmiOrObjectElements() || object->HasDoubleElements() ||
          object->HasFastArgumentsElements() ||
-         object->HasFastStringWrapperElements());
+         object->HasFastStringWrapperElements() || object->HasSealedElements());
 
   Handle<NumberDictionary> dictionary =
       object->GetElementsAccessor()->Normalize(object);

src/objects/js-objects.h

@@ -338,6 +338,7 @@ class JSObject : public JSReceiver {
   // Returns true if an object has elements of PACKED_ELEMENTS
   inline bool HasPackedElements();
   inline bool HasFrozenOrSealedElements();
+  inline bool HasSealedElements();
 
   inline bool HasTypedArrayElements();
 

test/mjsunit/regress-966460.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PI = [];
+PI[250] = PI;
+Object.seal(PI);
+assertTrue(Object.isSealed(PI));
+var proxy = new Proxy(PI, PI);
+Object.freeze(proxy);
+assertTrue(Object.isFrozen(proxy));