Bug 1090537, part 2b - In Proxy::set, do not assume that proxy == receiver or that both have the same handler. r=efaust, r=bholley.

--HG--
extra : rebase_source : 0aa0e3e37a2a95f3cfa0399e4380de73a95ab48a
This commit is contained in:
Jason Orendorff 2014-10-28 20:58:36 -05:00
parent 940ab6cec8
commit 66460e97d2
2 changed files with 14 additions and 12 deletions

View File

@ -0,0 +1,8 @@
// A scripted proxy can delegate a [[Set]] along to a target
// that's a different kind of proxy.
var target = {};
var wrapper = wrapWithProto(target, null);
var p = new Proxy(wrapper, {});
p.prop = 3;
assertEq(target.prop, 3);

View File

@ -365,18 +365,12 @@ Proxy::set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id
}
// Ok. Either there was no pre-existing property, or it was a value prop
// that we're going to shadow. Make a property descriptor and define it.
//
// Note that for pre-existing own value properties, we inherit the existing
// attributes, since we're really just changing the value and not trying to
// reconfigure the property.
Rooted<PropertyDescriptor> newDesc(cx);
if (desc.object() == proxy)
newDesc.setAttributes(desc.attributes());
else
newDesc.setAttributes(JSPROP_ENUMERATE);
newDesc.value().set(vp);
return handler->defineProperty(cx, receiver, id, &newDesc);
// that we're going to shadow. Either way, define a new own property.
unsigned attrs =
(desc.object() == proxy)
? JSPROP_IGNORE_ENUMERATE | JSPROP_IGNORE_READONLY | JSPROP_IGNORE_PERMANENT
: JSPROP_ENUMERATE;
return JSObject::defineGeneric(cx, receiver, id, vp, nullptr, nullptr, attrs);
}
bool