1175823 - Implement [[DefineOwnProperty]] for mapped arguments object.

js/src/jsobj.cpp

@@ -471,7 +471,7 @@ js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level)
 
     // Steps 8-9, loosely interpreted.
     if (obj->isNative() && !obj->as<NativeObject>().inDictionaryMode() &&
-        !obj->is<TypedArrayObject>())
+        !obj->is<TypedArrayObject>() && !obj->is<MappedArgumentsObject>())
     {
         HandleNativeObject nobj = obj.as<NativeObject>();
 

js/src/tests/test262/built-ins/Object/getOwnPropertyDescriptors/shell.js

@@ -1,27 +0,0 @@
-var assert = {
-    sameValue: assertEq,
-    notSameValue(a, b, msg) {
-      try {
-        assertEq(a, b);
-        throw "equal"
-      } catch (e) {
-        if (e === "equal")
-          throw new Error("Assertion failed: expected different values, got " + a);
-      }
-    },
-    throws(ctor, f) {
-      var fullmsg;
-      try {
-        f();
-      } catch (exc) {
-        if (exc instanceof ctor)
-          return;
-        fullmsg = "Assertion failed: expected exception " + ctor.name + ", got " + exc;
-      }
-      if (fullmsg === undefined)
-        fullmsg = "Assertion failed: expected exception " + ctor.name + ", no exception thrown";
-      if (msg !== undefined)
-        fullmsg += " - " + msg;
-      throw new Error(fullmsg);
-    }
-}

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-1.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped value is not changed when property was made non-configurable.
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurable(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonConfigurable(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-2.js

@@ -0,0 +1,19 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, variable is
+    changed with SetMutableBinding.
+flags: [noStrict]
+---*/
+
+function argumentsAndSetMutableBinding(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndSetMutableBinding(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-3.js

@@ -0,0 +1,19 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    is changed with [[DefineOwnProperty]].
+flags: [noStrict]
+---*/
+
+function argumentsAndDefineOwnProperty(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  Object.defineProperty(arguments, "0", {value: 2});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndDefineOwnProperty(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-4.js

@@ -0,0 +1,19 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    is changed with [[Set]].
+flags: [noStrict]
+---*/
+
+function argumentsAndSet(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  arguments[0] = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndSet(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-1.js

@@ -0,0 +1,19 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. [[Delete]] operation returns false.
+flags: [noStrict]
+---*/
+
+function argumentsAndDelete(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  assert.sameValue(delete arguments[0], false);
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsAndDelete(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-2.js

@@ -0,0 +1,24 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. Variable is changed with SetMutableBinding.
+flags: [noStrict]
+---*/
+
+function argumentsAndDeleteSetMutableBinding(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  assert.sameValue(delete arguments[0], false);
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndDeleteSetMutableBinding(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-3.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. Arguments property is changed with
+    [[DefineOwnProperty]].
+flags: [noStrict]
+---*/
+
+function argumentsAndDeleteDefineOwnProperty(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  assert.sameValue(delete arguments[0], false);
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  Object.defineProperty(arguments, "0", {value: 2});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndDeleteDefineOwnProperty(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-4.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. Arguments property is changed with
+    [[Set]].
+flags: [noStrict]
+---*/
+
+function argumentsAndDeleteSet(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  assert.sameValue(delete arguments[0], false);
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  arguments[0] = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndDeleteSet(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-1.js

@@ -0,0 +1,24 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-configurable and
+    non-writable. Perform property attribute changes with a single
+    [[DefineOwnProperty]] call. Mapped values are unchanged, mapping
+    itself is removed.
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurableAndNonWritable(a) {
+  Object.defineProperty(arguments, "0", {configurable: false, writable: false});
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonConfigurableAndNonWritable(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-2.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-configurable and
+    non-writable. Perform property attribute changes with two
+    consecutive [[DefineOwnProperty]] calls. Mapped values are
+    unchanged, mapping itself is removed.
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurableThenNonWritable(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+  Object.defineProperty(arguments, "0", {writable: false});
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonConfigurableThenNonWritable(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-3.js

@@ -0,0 +1,28 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-configurable and
+    non-writable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to
+    SetMutableBinding.
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurableThenNonWritableWithInterveningSetMutableBinding(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+  a = 2;
+  Object.defineProperty(arguments, "0", {writable: false});
+  assert.sameValue(a, 2);
+  // `arguments[0] === 1` per ES2015, Rev 38, April 14, 2015 Final Draft.
+  // Specification bug: https://bugs.ecmascript.org/show_bug.cgi?id=4371
+  assert.sameValue(arguments[0], 2);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsNonConfigurableThenNonWritableWithInterveningSetMutableBinding(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-4.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-configurable and
+    non-writable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to [[Set]].
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurableThenNonWritableWithInterveningSet(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+  arguments[0] = 2;
+  Object.defineProperty(arguments, "0", {writable: false});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsNonConfigurableThenNonWritableWithInterveningSet(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-5.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-configurable and
+    non-writable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to
+    [[DefineOwnProperty]].
+flags: [noStrict]
+---*/
+
+function argumentsNonConfigurableThenNonWritableWithDefineOwnProperty(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+  Object.defineProperty(arguments, "0", {value: 2});
+  Object.defineProperty(arguments, "0", {writable: false});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsNonConfigurableThenNonWritableWithDefineOwnProperty(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-1.js

@@ -0,0 +1,21 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. [[Delete]] operations throws TypeError if called
+    from strict-mode code.
+flags: [noStrict]
+---*/
+
+function argumentsAndStrictDelete(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  var args = arguments;
+  assert.throws(TypeError, function() { "use strict"; delete args[0]; });
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsAndStrictDelete(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-2.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. [[Delete]] operations throws TypeError if called
+    from strict-mode code. Variable is changed with SetMutableBinding.
+flags: [noStrict]
+---*/
+
+function argumentsAndStrictDeleteSetMutableBinding(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  var args = arguments;
+  assert.throws(TypeError, function() { "use strict"; delete args[0]; });
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndStrictDeleteSetMutableBinding(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-3.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. [[Delete]] operations throws TypeError if called
+    from strict-mode code. Arguments property is changed with
+    [[DefineOwnProperty]].
+flags: [noStrict]
+---*/
+
+function argumentsAndStrictDeleteDefineOwnProperty(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  var args = arguments;
+  assert.throws(TypeError, function() { "use strict"; delete args[0]; });
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  Object.defineProperty(arguments, "0", {value: 2});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndStrictDeleteDefineOwnProperty(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-4.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapping works when property is non-configurable, arguments property
+    was not deleted. [[Delete]] operations throws TypeError if called
+    from strict-mode code. Arguments property is changed with [[Set]].
+flags: [noStrict]
+---*/
+
+function argumentsAndStrictDeleteSet(a) {
+  Object.defineProperty(arguments, "0", {configurable: false});
+
+  // Precondition: Delete is unsuccessful and doesn't affect mapping.
+  var args = arguments;
+  assert.throws(TypeError, function() { "use strict"; delete args[0]; });
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  arguments[0] = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsAndStrictDeleteSet(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonwritable-nonconfigurable-1.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-writable and
+    non-configurable. Perform property attribute changes with two
+    consecutive [[DefineOwnProperty]] calls. Mapped values are
+    unchanged, mapping itself is removed.
+flags: [noStrict]
+---*/
+
+function argumentsNonWritableThenNonConfigurable(a) {
+  Object.defineProperty(arguments, "0", {writable: false});
+  Object.defineProperty(arguments, "0", {configurable: false});
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 2;
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonWritableThenNonConfigurable(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonwritable-nonconfigurable-2.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-writable and
+    non-configurable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to
+    SetMutableBinding.
+flags: [noStrict]
+---*/
+
+function argumentsNonWritableThenNonConfigurableWithInterveningSetMutableBinding(a) {
+  Object.defineProperty(arguments, "0", {writable: false});
+  a = 2;
+  Object.defineProperty(arguments, "0", {configurable: false});
+  assert.sameValue(a, 2);
+  assert.sameValue(arguments[0], 1);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonWritableThenNonConfigurableWithInterveningSetMutableBinding(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonwritable-nonconfigurable-3.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-writable and
+    non-configurable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to [[Set]].
+flags: [noStrict]
+---*/
+
+function argumentsNonWritableThenNonConfigurableWithInterveningSet(a) {
+  Object.defineProperty(arguments, "0", {writable: false});
+  arguments[0] = 2;
+  Object.defineProperty(arguments, "0", {configurable: false});
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 1);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 1);
+}
+argumentsNonWritableThenNonConfigurableWithInterveningSet(1);

js/src/tests/test262/language/arguments-object/mapped/mapped-arguments-nonwritable-nonconfigurable-4.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+info: Mapped arguments object with non-configurable property
+description: >
+    Mapped arguments property is changed to non-writable and
+    non-configurable. Perform property attribute changes with two
+    [[DefineOwnProperty]] calls. Add intervening call to
+    [[DefineOwnProperty]].
+flags: [noStrict]
+---*/
+
+function argumentsNonWritableThenNonConfigurableWithInterveningDefineOwnProperty(a) {
+  Object.defineProperty(arguments, "0", {writable: false});
+  Object.defineProperty(arguments, "0", {value: 2});
+  Object.defineProperty(arguments, "0", {configurable: false});
+  assert.sameValue(a, 1);
+  assert.sameValue(arguments[0], 2);
+
+  // Postcondition: Arguments mapping is removed.
+  a = 3;
+  assert.sameValue(a, 3);
+  assert.sameValue(arguments[0], 2);
+}
+argumentsNonWritableThenNonConfigurableWithInterveningDefineOwnProperty(1);

js/src/tests/test262/shell.js

@@ -938,3 +938,31 @@ var fnGlobalObject = (function()
   var global = Function("return this")();
   return function fnGlobalObject() { return global; };
 })();
+
+var assert = {
+    sameValue: assertEq,
+    notSameValue(a, b, msg) {
+      try {
+        assertEq(a, b);
+        throw "equal"
+      } catch (e) {
+        if (e === "equal")
+          throw new Error("Assertion failed: expected different values, got " + a);
+      }
+    },
+    throws(ctor, f) {
+      var fullmsg;
+      try {
+        f();
+      } catch (exc) {
+        if (exc instanceof ctor)
+          return;
+        fullmsg = "Assertion failed: expected exception " + ctor.name + ", got " + exc;
+      }
+      if (fullmsg === undefined)
+        fullmsg = "Assertion failed: expected exception " + ctor.name + ", no exception thrown";
+      if (msg !== undefined)
+        fullmsg += " - " + msg;
+      throw new Error(fullmsg);
+    }
+}

js/src/vm/ArgumentsObject.cpp

@@ -590,6 +590,64 @@ MappedArgumentsObject::obj_enumerate(JSContext* cx, HandleObject obj)
     return true;
 }
 
+// ES 2017 draft 9.4.4.2
+/* static */ bool
+MappedArgumentsObject::obj_defineProperty(JSContext* cx, HandleObject obj, HandleId id,
+                                          Handle<PropertyDescriptor> desc, ObjectOpResult& result)
+{
+    // Step 1.
+    Rooted<MappedArgumentsObject*> argsobj(cx, &obj->as<MappedArgumentsObject>());
+
+    // Steps 2-3.
+    bool isMapped = false;
+    if (JSID_IS_INT(id)) {
+        unsigned arg = unsigned(JSID_TO_INT(id));
+        isMapped = arg < argsobj->initialLength() && !argsobj->isElementDeleted(arg);
+    }
+
+    // Step 4.
+    Rooted<PropertyDescriptor> newArgDesc(cx, desc);
+    if (!desc.isAccessorDescriptor() && isMapped) {
+        // In this case the live mapping is supposed to keep working,
+        // we have to pass along the Getter/Setter otherwise they are overwritten.
+        newArgDesc.setGetter(MappedArgGetter);
+        newArgDesc.setSetter(MappedArgSetter);
+    }
+
+    // Steps 5-6. NativeDefineProperty will lookup [[Value]] for us.
+    if (!NativeDefineProperty(cx, obj.as<NativeObject>(), id, newArgDesc, result))
+        return false;
+    // Step 7.
+    if (!result.ok())
+        return true;
+
+    // Step 8.
+    if (isMapped) {
+        unsigned arg = unsigned(JSID_TO_INT(id));
+        if (desc.isAccessorDescriptor()) {
+            if (!argsobj->markElementDeleted(cx, arg))
+                return false;
+        } else {
+            if (desc.hasValue()) {
+                RootedFunction callee(cx, &argsobj->callee());
+                RootedScript script(cx, callee->getOrCreateScript(cx));
+                if (!script)
+                    return false;
+                argsobj->setElement(cx, arg, desc.value());
+                if (arg < script->functionNonDelazifying()->nargs())
+                    TypeScript::SetArgument(cx, script, arg, desc.value());
+            }
+            if (desc.hasWritable() && !desc.writable()) {
+                if (!argsobj->markElementDeleted(cx, arg))
+                    return false;
+            }
+        }
+    }
+
+    // Step 9.
+    return result.succeed();
+}
+
 static bool
 UnmappedArgGetter(JSContext* cx, HandleObject obj, HandleId id, MutableHandleValue vp)
 {
@@ -804,6 +862,11 @@ const ClassOps MappedArgumentsObject::classOps_ = {
     ArgumentsObject::trace
 };
 
+const ObjectOps MappedArgumentsObject::objectOps_ = {
+    nullptr,                 /* lookupProperty */
+    MappedArgumentsObject::obj_defineProperty
+};
+
 const Class MappedArgumentsObject::class_ = {
     "Arguments",
     JSCLASS_DELAY_METADATA_BUILDER |
@@ -811,7 +874,10 @@ const Class MappedArgumentsObject::class_ = {
     JSCLASS_HAS_CACHED_PROTO(JSProto_Object) |
     JSCLASS_SKIP_NURSERY_FINALIZE |
     JSCLASS_BACKGROUND_FINALIZE,
-    &MappedArgumentsObject::classOps_
+    &MappedArgumentsObject::classOps_,
+    nullptr,
+    nullptr,
+    &MappedArgumentsObject::objectOps_
 };
 
 /*

js/src/vm/ArgumentsObject.h

@@ -389,6 +389,7 @@ class ArgumentsObject : public NativeObject
 class MappedArgumentsObject : public ArgumentsObject
 {
     static const ClassOps classOps_;
+    static const ObjectOps objectOps_;
 
   public:
     static const Class class_;
@@ -410,6 +411,8 @@ class MappedArgumentsObject : public ArgumentsObject
   private:
     static bool obj_enumerate(JSContext* cx, HandleObject obj);
     static bool obj_resolve(JSContext* cx, HandleObject obj, HandleId id, bool* resolvedp);
+    static bool obj_defineProperty(JSContext* cx, HandleObject obj, HandleId id,
+                                   Handle<JS::PropertyDescriptor> desc, ObjectOpResult& result);
 };
 
 class UnmappedArgumentsObject : public ArgumentsObject