Bug 154768 – ProxyObject.[[GetOwnProperty]] is partially broken because it doesn't propagate information back to the slot

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

...

[Saam Barati]

Created attachment 272397 [details]
patch

[Ryosuke Niwa]

Comment on attachment 272397 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=272397&action=review

> Source/JavaScriptCore/ChangeLog:10
> +        This fixes a big bug with ProxyObject.[[GetOwnProperty]]. We weren't
> +        correctly propagating the result of this operation to the out PropertySlot&
> +        parameter. This patch fixes that and adds tests.

Can we refer to http://www.ecma-international.org/ecma-262/6.0/#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
either in the change log or in the code?

> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:236
>      JSObject* description = constructEmptyObject(exec);
> +    if (exec->hadException())
> +        return jsUndefined();

Please mention this change in the change log.

> Source/JavaScriptCore/runtime/ProxyObject.cpp:216
> +        GetterSetter* getterSetter = trapResultAsDescriptor.slowGetterSetter(exec);
> +        if (exec->hadException())
> +            return false;

I guess the only way we can fail here would be memory exhaustion?
Otherwise, we should be careful about the order in which these conditions are checked as they're observable.

[Saam Barati]

landed in:
http://trac.webkit.org/changeset/197295