699705 - Getting a property off an array that lives on a non-native on the proto chain and has a getter that uses |this| fails

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Boris Zbarsky [:bzbarsky]]

The problem is that we use js_NativeGet and hence have to stick to native objects.  This is a remaining unfixed case from bug 434837.  At the time we had no way to fix, but now we do.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: When forwarding property gets to the proto for arrays, send along the right receiver even if the property lives on a non-native object.

Comment 2

[Jeff Walden [:Waldo]]

As I noted on IRC, this patch demonstrates one reason why we should make getOwnProperty, in some form, the fundamental property-get operation.  Every one of these methods has to hard-code the property-delegation lookup process, and every one has to be fixed if a bug is found, as here.  I started this in bug 637378 half a year ago and hit a nontrivial XBL-based snag.  Perhaps we should go back and beat XBL into submission so we could move further in that direction...

Comment 3

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bdd8a7d0d45a

Comment 4

[Marco Bonardo [:mak] (Away Apr 25 - May 5)]

https://hg.mozilla.org/mozilla-central/rev/bdd8a7d0d45a