[wasm] Freeze exports object

We were not conforming to the spec before.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2587913005
Cr-Commit-Position: refs/heads/master@{#41822}

src/wasm/wasm-module.cc

@@ -1846,6 +1846,13 @@ class WasmInstanceBuilder {
         return;
       }
     }
+
+    if (module_->origin == kWasmOrigin) {
+      v8::Maybe<bool> success = JSReceiver::SetIntegrityLevel(
+          exports_object, FROZEN, Object::DONT_THROW);
+      DCHECK(success.FromMaybe(false));
+      USE(success);
+    }
   }
 
   void InitializeTables(Handle<FixedArray> code_table,

test/mjsunit/wasm/add-getters.js

@@ -12,6 +12,13 @@ function testAddGetter(object, name, val) {
   assertSame(val, object[name]);
 }
 
+function testAddGetterFails(object, name, val) {
+  function assign() {
+    Object.defineProperty(object, name, { get: function() { return val; } });
+  }
+  assertThrows(assign, TypeError);
+}
+
 function testAddGetterBothWays(object, name, val) {
   print("Object.defineProperty");
   Object.defineProperty(object, name, { get: function() { return val; } });
@@ -64,5 +71,5 @@ function makeBuilder() {
   var builder = makeBuilder();
   var exports = builder.instantiate().exports;
   testFailToAddGetter(exports, "f", 9834);
-  testAddGetter(exports, "nag", new Number(2));
+  testAddGetterFails(exports, "nag", new Number(2));
 })();

test/mjsunit/wasm/instantiate-module-basic.js

@@ -25,6 +25,10 @@ function CheckInstance(instance) {
   assertFalse(instance === 0);
   assertEquals("object", typeof instance);
 
+  // Check the exports object is frozen.
+  assertFalse(Object.isExtensible(instance.exports));
+  assertTrue(Object.isFrozen(instance.exports));
+
   // Check the memory is an ArrayBuffer.
   var mem = instance.exports.memory;
   assertFalse(mem === undefined);