RESOLVED FIXED120052
Remove custom getOwnPropertyDescriptor for JSProxy 
https://bugs.webkit.org/show_bug.cgi?id=120052
Summary Remove custom getOwnPropertyDescriptor for JSProxy
Gavin Barraclough
Reported 2013-08-19 23:46:36 PDT
GET_OWN_PROPERTY_DESCRIPTOR_IMPL runs afoul with JSProxy due to the workaround for JSDOMWindow's broken behavior. Because the window object incorrectly searches the prototype chain in getOwnPropertySlot we check that the base object matches, but in the case of JSProxy we can end up comparing the window object to the window shell & falsely assuming this is a prototype property. Add toThis conversion to correctly identify proxied own access. I've kept the original slotBase check as a fast case, and also so that direct access on JSDOMWindow still works.
Attachments
Fix (3.08 KB, patch)
2013-08-19 23:51 PDT, Gavin Barraclough 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2013-08-19 23:51:04 PDT
Created attachment 209162 [details] Fix
Geoffrey Garen
Comment 2 2013-08-20 09:37:53 PDT
Comment on attachment 209162 [details] Fix r=me
Gavin Barraclough
Comment 3 2013-08-20 10:05:59 PDT
Committed revision 154334.
Note You need to log in before you can comment on or make changes to this bug.