Skip to content

Use a safer mechanism for freezing intrinsics#148

Open
kriszyp wants to merge 3 commits intomainfrom
better-intrinsic-freeze
Open

Use a safer mechanism for freezing intrinsics#148
kriszyp wants to merge 3 commits intomainfrom
better-intrinsic-freeze

Conversation

@kriszyp
Copy link
Member

@kriszyp kriszyp commented Feb 15, 2026

The issue is most easily described with:

$ node --use-strict
> Object.freeze(Object.prototype)
[Object: null prototype] {}
> let o = {}
undefined
> o.toString = () => 'hi'
Uncaught TypeError: Cannot assign to read only property 'toString' of object '#<Object>'

Note that this code is not attempting to modify Object.prototype, it is simply performing a very reasonable assignment of the toString property on a plain object. But it throws an error because it "inherits" the read-only-ness of the property slot. And this causes a lot of problems for 3rd party packages.

This fix defines commonly assigned properties with an overridable version of the method that uses a setter to properly allow the value to be set on the derivative object, and then freezing, allowing the property assignment to work properly. I verified that next.js can indeed load properly with this environment freeze in place.

Also note that with this lockdown as the default, the isolation unit tests are running with this freeze in place and testing it.

@kriszyp kriszyp force-pushed the better-intrinsic-freeze branch from 1a0d7ff to d47dea1 Compare February 16, 2026 04:41
@kriszyp kriszyp changed the base branch from rocksdb to main February 16, 2026 04:45
@kriszyp kriszyp changed the title Use a safer mechanism for freezing intrinsics that can be enabled by … Use a safer mechanism for freezing intrinsics Feb 16, 2026
@kriszyp kriszyp marked this pull request as ready for review February 16, 2026 14:00
@kriszyp kriszyp requested a review from a team as a code owner February 16, 2026 14:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant