With this patch:
* SetPropertyHelper no longer calls lookupProperty hooks, which is nice
since there's no such thing in ES6.
* As SetPropertyHelper walks the prototype chain, as soon as it reaches a
non-native object, it calls that object's set hook, passing the original
receiver, and returns.
This means Proxy set traps will now be called per spec when triggered via
the prototype chain from a native object.
It also means that legacy scripted indirect proxies (Proxy.create) will
now sometimes have their set trap called when it wouldn't have been called
before. This seems to be confined to fuzztests in practice, since it only
matters when the proxy is used as the prototype of an ordinary object.
But it could cause trouble.
The same situation affects other proxies too: BaseProxyHandler::set() and
its overrides will all be called in new situations. It's inevitable though;
Reflect.set was going to enable all these situations anyway.
--HG--
extra : rebase_source : 01bb32b4950ea14922f135bf785aea7d298c8dfb
At this point, SetPropertyHelper has been factored into five parts:
SetPropertyByDefining
SetNonexistentProperty
SetDenseOrTypedArrayElement
SetExistingProperty
SetPropertyHelper
each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.
--HG--
extra : rebase_source : 4d32ae23b5cdbaa357c205766894dfaa2184c755
As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.
--HG--
extra : rebase_source : f939b92b42f0470fb0309097fb82f46383a61b25
extra : source : 1ecbc62d82a38e6e36e6ede090d711f3b3ad13ba
This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)
Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.
This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.
--HG--
extra : rebase_source : c968a95baf41944ca82a16d40af51a1512ad0938
extra : source : f322eac33cfa1b54486d1d73f62658019774e373
We are white-listing the existing set of tests that use setTimeout
like this. Hopefully these tests will be investigated and fixed
in the future, so that we can narrow down the white-list.
This check is only turned on for mochitest-plain for now.
With this patch:
* SetPropertyHelper no longer calls lookupProperty hooks, which is nice
since there's no such thing in ES6.
* As SetPropertyHelper walks the prototype chain, as soon as it reaches a
non-native object, it calls that object's set hook, passing the original
receiver, and returns.
This means Proxy set traps will now be called per spec when triggered via
the prototype chain from a native object.
It also means that legacy scripted indirect proxies (Proxy.create) will
now sometimes have their set trap called when it wouldn't have been called
before. This seems to be confined to fuzztests in practice, since it only
matters when the proxy is used as the prototype of an ordinary object.
But it could cause trouble.
The same situation affects other proxies too: BaseProxyHandler::set() and
its overrides will all be called in new situations. It's inevitable though;
Reflect.set was going to enable all these situations anyway.
--HG--
extra : rebase_source : afd950d3593f5c6dc2c24c8aec92567d9c1269d2
At this point, SetPropertyHelper has been factored into five parts:
SetPropertyByDefining
SetNonexistentProperty
SetDenseOrTypedArrayElement
SetExistingProperty
SetPropertyHelper
each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.
--HG--
extra : rebase_source : 590d09b7da81417f44580b06b5d5b4e634b641fa
As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.
--HG--
extra : rebase_source : 1e2741d096f5ac72ae8305aa548747242b44ace7
This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)
Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.
This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.
--HG--
extra : rebase_source : 18704b24f65bd3336d5c2b2f3e7366b01e7fcec0
