Bug 814892 - Actually compare the right values when making sure a proxy [[Get]] trap returns the correct value. r=efaust

--HG--
extra : rebase_source : 3c7db79ef75d22624f973b4e3ef1fe4b389c24b3

js/src/jit-test/tests/proxy/testDirectProxyGet3.js

@@ -17,3 +17,48 @@ assertThrowsInstanceOf(function () {
         }
     })['foo'];
 }, TypeError);
+
+/*
+ * Don't throw a TypeError if the trap reports the same value for a non-writable,
+ * non-configurable property
+ */
+assertEq(new Proxy(target, {
+        get: function (target, name, receiver) {
+            return 'bar';
+        }
+    })['foo'],
+    'bar');
+
+
+/*
+ * Don't throw a TypeError if the trap reports a different value for a writable,
+ * non-configurable property
+ */
+Object.defineProperty(target, 'prop', {
+    value: 'bar',
+    writable: true,
+    configurable: false
+});
+assertEq(new Proxy(target, {
+        get: function (target, name, receiver) {
+            return 'baz';
+        }
+    })['prop'],
+    'baz');
+
+
+/*
+ * Don't throw a TypeError if the trap reports a different value for a non-writable,
+ * configurable property
+ */
+Object.defineProperty(target, 'prop2', {
+    value: 'bar',
+    writable: false,
+    configurable: true
+});
+assertEq(new Proxy(target, {
+        get: function (target, name, receiver) {
+            return 'baz';
+        }
+    })['prop2'],
+    'baz');

js/src/jsproxy.cpp

@@ -2109,7 +2109,7 @@ ScriptedDirectProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObject
     if (desc.object()) {
         if (IsDataDescriptor(desc) && desc.isPermanent() && desc.isReadonly()) {
             bool same;
-            if (!SameValue(cx, vp, desc.value(), &same))
+            if (!SameValue(cx, trapResult, desc.value(), &same))
                 return false;
             if (!same) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MUST_REPORT_SAME_VALUE);