diff --git a/js/src/jit-test/tests/basic/proxy-assign-inherited.js b/js/src/jit-test/tests/basic/proxy-assign-inherited.js new file mode 100644 index 00000000000..73276eb3f35 --- /dev/null +++ b/js/src/jit-test/tests/basic/proxy-assign-inherited.js @@ -0,0 +1,21 @@ +// When we assign to a property that a proxy claims is inherited, the +// defineProperty handler call to create the new own property should get +// the newly assigned value. + +var hits; +var handlers = { + getOwnPropertyDescriptor: function(name) { + return undefined; + }, + getPropertyDescriptor: function(name) { + return { value:42, writable:true, enumerable:true, configurable:true }; + }, + defineProperty: function(name, descriptor) { + hits++; + assertEq(name, 'x'); + assertEq(descriptor.value, 43); + } +}; +hits = 0; +Proxy.create(handlers).x = 43; +assertEq(hits, 1); \ No newline at end of file diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp index 79e01b1c14f..fc213c9f5fd 100644 --- a/js/src/jsproxy.cpp +++ b/js/src/jsproxy.cpp @@ -205,6 +205,7 @@ BaseProxyHandler::set(JSContext *cx, JSObject *proxy, JSObject *receiver_, jsid if (!(desc.attrs & JSPROP_GETTER)) desc.getter = JS_PropertyStub; } + desc.value = *vp; return defineProperty(cx, receiver, id, &desc); }