Dev mode protection against this.set(<string>) doesn't work

[tivac]

In dev mode, svelte wraps set calls in _setDev which checks to ensure that the first arg is an object, to protect against this.set("foo", 1). Which is great.

Except it doesn't currently work due to a quirk of the set() implementation.

set(newState) uses this._set(assign({}, newState)), which is calling out to the assign() function. So far so good.

Except that when the newState value is a string, assign() doesn't handle it very well.

So _setDev() ends up getting passed a nonsense object, which bypasses the check for a string value and the error is never shown.

<h1>{{key}}</h1>
<script>
export default {
   data() {
        return { key : false };
    },
    oncreate() {
        this.set("key", true);
    }
}
</script>

Will end up invoking _setDev() with an arg like { 0 : "k", 1 : "e", 2 : "y" }, which passes the typeof check and then does nothing useful.

[Rich-Harris]

fixed in 1.46.1, thanks