Bug 738244: Fix proxy behavior when assigning to inherited properties.

js/src/jit-test/tests/basic/proxy-assign-inherited.js

@@ -0,0 +1,21 @@
+// When we assign to a property that a proxy claims is inherited, the
+// defineProperty handler call to create the new own property should get
+// the newly assigned value.
+
+var hits;
+var handlers = {
+  getOwnPropertyDescriptor: function(name) {
+    return undefined;
+  },
+  getPropertyDescriptor: function(name) {
+    return { value:42, writable:true, enumerable:true, configurable:true };
+  },
+  defineProperty: function(name, descriptor) {
+    hits++;
+    assertEq(name, 'x');
+    assertEq(descriptor.value, 43);
+  }
+};
+hits = 0;
+Proxy.create(handlers).x = 43;
+assertEq(hits, 1);

js/src/jsproxy.cpp

@@ -205,6 +205,7 @@ BaseProxyHandler::set(JSContext *cx, JSObject *proxy, JSObject *receiver_, jsid
             if (!(desc.attrs & JSPROP_GETTER))
                 desc.getter = JS_PropertyStub;
         }
+        desc.value = *vp;
         return defineProperty(cx, receiver, id, &desc);
     }