Some base work on it started in bug 430133 (Object.defineProperty), but the meat -- atomicity -- is complex and remains to be completed.
Can you write a JSTempVector-based log of facts to check, then lock the object's own scope and do the checks, and unlock and throw if any check fails, else do a bunch of adds and changes? /be
Well, that's about the plan, it's just there are about a billion different facts to check, and you really do have to modify the object so you can invoke JSClass.addProperty with something that looks right, and it gets complicated really fast. It's doable certainly -- just not as useful or necessary as other things, especially once you have the Object.defineProperty building block with which you can construct these larger edifices if you structure your code differently to do all property-definition before handing an object off to the greater world of whatever scripts will use it.
Whee, atomicity is getting killed, which makes this bug unnecessary -- we should be able to fold it back into bug 430133 with fairly little effort given that I already wrote the code in a previous patch there for a non-atomic version.