From af73908e85760e3c56591a65a8409d85f642a6ac Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Fri, 13 Nov 2015 18:22:21 -0800
Subject: [PATCH] Bug 1055472 - Part 12: Mae the WeakSet constructor properly
 subclassable. (r=Waldo)

---
 js/src/builtin/WeakSetObject.cpp              | 23 +++++++++++--------
 js/src/builtin/WeakSetObject.h                |  2 +-
 .../ecma_6/Class/extendBuiltinConstructors.js |  1 +
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/js/src/builtin/WeakSetObject.cpp b/js/src/builtin/WeakSetObject.cpp
index 0642bef03e6..4f748d78eb8 100644
--- a/js/src/builtin/WeakSetObject.cpp
+++ b/js/src/builtin/WeakSetObject.cpp
@@ -61,14 +61,14 @@ WeakSetObject::initClass(JSContext* cx, JSObject* obj)
 }
 
 WeakSetObject*
-WeakSetObject::create(JSContext* cx)
+WeakSetObject::create(JSContext* cx, HandleObject proto /* = nullptr */)
 {
-    Rooted<WeakSetObject*> obj(cx, NewBuiltinClassInstance<WeakSetObject>(cx));
-    if (!obj)
+    RootedObject map(cx, NewBuiltinClassInstance<WeakMapObject>(cx));
+    if (!map)
         return nullptr;
 
-    RootedObject map(cx, JS::NewWeakMapObject(cx));
-    if (!map)
+    WeakSetObject* obj = NewObjectWithClassProto<WeakSetObject>(cx, proto);
+    if (!obj)
         return nullptr;
 
     obj->setReservedSlot(WEAKSET_MAP_SLOT, ObjectValue(*map));
@@ -78,16 +78,21 @@ WeakSetObject::create(JSContext* cx)
 bool
 WeakSetObject::construct(JSContext* cx, unsigned argc, Value* vp)
 {
-    Rooted<WeakSetObject*> obj(cx, WeakSetObject::create(cx));
-    if (!obj)
-        return false;
-
     // Based on our "Set" implementation instead of the more general ES6 steps.
     CallArgs args = CallArgsFromVp(argc, vp);
 
     if (!ThrowIfNotConstructing(cx, args, "WeakSet"))
         return false;
 
+    RootedObject proto(cx);
+    RootedObject newTarget(cx, &args.newTarget().toObject());
+    if (!GetPrototypeFromConstructor(cx, newTarget, &proto))
+        return false;
+
+    Rooted<WeakSetObject*> obj(cx, WeakSetObject::create(cx, proto));
+    if (!obj)
+        return false;
+
     if (!args.get(0).isNullOrUndefined()) {
         RootedObject map(cx, &obj->getReservedSlot(WEAKSET_MAP_SLOT).toObject());
 
diff --git a/js/src/builtin/WeakSetObject.h b/js/src/builtin/WeakSetObject.h
index 308b67e67fc..9aa4fc51d63 100644
--- a/js/src/builtin/WeakSetObject.h
+++ b/js/src/builtin/WeakSetObject.h
@@ -23,7 +23,7 @@ class WeakSetObject : public NativeObject
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
 
-    static WeakSetObject* create(JSContext* cx);
+    static WeakSetObject* create(JSContext* cx, HandleObject proto = nullptr);
     static bool construct(JSContext* cx, unsigned argc, Value* vp);
 };
 
diff --git a/js/src/tests/ecma_6/Class/extendBuiltinConstructors.js b/js/src/tests/ecma_6/Class/extendBuiltinConstructors.js
index 364dee0ca4e..4c3e8ed7fbb 100644
--- a/js/src/tests/ecma_6/Class/extendBuiltinConstructors.js
+++ b/js/src/tests/ecma_6/Class/extendBuiltinConstructors.js
@@ -35,6 +35,7 @@ testBuiltin(RegExp, "String Argument");
 testBuiltin(Map);
 testBuiltin(Set);
 testBuiltin(WeakMap);
+testBuiltin(WeakSet);
 
 `;