From e6258a30e4cf1f4ea9932da4e03e961ba675e474 Mon Sep 17 00:00:00 2001
From: Gabor Krizsanits <gkrizsanits@mozilla.com>
Date: Thu, 7 Jun 2012 18:31:31 -0700
Subject: [PATCH] Bug 738244: Fix proxy behavior when assigning to inherited
 properties.

---
 .../tests/basic/proxy-assign-inherited.js     | 21 +++++++++++++++++++
 js/src/jsproxy.cpp                            |  1 +
 2 files changed, 22 insertions(+)
 create mode 100644 js/src/jit-test/tests/basic/proxy-assign-inherited.js

diff --git a/js/src/jit-test/tests/basic/proxy-assign-inherited.js b/js/src/jit-test/tests/basic/proxy-assign-inherited.js
new file mode 100644
index 00000000000..73276eb3f35
--- /dev/null
+++ b/js/src/jit-test/tests/basic/proxy-assign-inherited.js
@@ -0,0 +1,21 @@
+// When we assign to a property that a proxy claims is inherited, the
+// defineProperty handler call to create the new own property should get
+// the newly assigned value.
+
+var hits;
+var handlers = {
+  getOwnPropertyDescriptor: function(name) {
+    return undefined;
+  },
+  getPropertyDescriptor: function(name) {
+    return { value:42, writable:true, enumerable:true, configurable:true };
+  },
+  defineProperty: function(name, descriptor) {
+    hits++;
+    assertEq(name, 'x');
+    assertEq(descriptor.value, 43);
+  }
+};
+hits = 0;
+Proxy.create(handlers).x = 43;
+assertEq(hits, 1);
\ No newline at end of file
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 79e01b1c14f..fc213c9f5fd 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -205,6 +205,7 @@ BaseProxyHandler::set(JSContext *cx, JSObject *proxy, JSObject *receiver_, jsid
             if (!(desc.attrs & JSPROP_GETTER))
                 desc.getter = JS_PropertyStub;
         }
+        desc.value = *vp;
         return defineProperty(cx, receiver, id, &desc);
     }