Freeze the array object for the MessageEvent ports attribute

components/script/dom/messageevent.rs

@@ -18,7 +18,8 @@ use crate::dom::messageport::MessagePort;
 use crate::dom::windowproxy::WindowProxy;
 use dom_struct::dom_struct;
 use js::conversions::ToJSValConvertible;
-use js::jsapi::{Heap, JSContext, JSObject};
+use js::jsapi::{Heap, JS_FreezeObject, JSContext, JSObject};
+use js::jsapi::HandleObject as RawHandleObject;
 use js::jsval::{JSVal, UndefinedValue};
 use js::rust::HandleValue;
 use servo_atoms::Atom;
@@ -171,6 +172,9 @@ impl MessageEventMethods for MessageEvent {
     unsafe fn Ports(&self, cx: *mut JSContext) -> JSVal {
         rooted!(in(cx) let mut ports = UndefinedValue());
         self.ports.to_jsval(cx, ports.handle_mut());
+
+        rooted!(in(cx) let obj = ports.to_object());
+        JS_FreezeObject(cx, RawHandleObject::from(obj.handle()));
         *ports
     }
 }