I missed writing some of these tests because I didn't realize you could easily make an object get into this state. But it's super easy. Object.preventExtensions puts an object into this state.
This is referenced from this commit: http://trac.webkit.org/changeset/197539. That suggests that maybe that commit should have referenced a different bug?
(In reply to comment #1) > This is referenced from this commit: http://trac.webkit.org/changeset/197539. > > That suggests that maybe that commit should have referenced a different bug? Yeah it definitely should have. That was a mistake on my end. Is it worth going back and editing the change log?
Test262 has complete coverage of internal methods invariants being validated by proxies, including non-extensible targets and non-configurable properties. Just a few of them: https://test262.report/browse/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable.js https://test262.report/browse/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible.js https://test262.report/browse/built-ins/Proxy/set/target-property-is-not-configurable-not-writable-not-equal-to-v.js https://test262.report/browse/built-ins/Proxy/set/return-true-target-property-is-not-configurable.js https://test262.report/browse/built-ins/Proxy/isExtensible/return-is-different-from-target.js