1111604 - Proxy doesn't play well with array_length_getter

Status: RESOLVED DUPLICATE of bug 895223

(Core :: JavaScript Engine, defect)

Description

[Tom S [:evilpie]]

Because array_length_getter doesn't expect a Proxy object as "this", we always get a length of 0 for proxies with an array target.

var p = new Proxy(['a', 'b'], {})
p.length >> 0

JSON.stringify(new Proxy(['a', 'b'], {})) >> "[]"

Comment 1

[Jason Orendorff [:jorendorff]]

Yeah, my current work doesn't fix this.

1. One fix here is to treat properties with JSPropertyOp getters strictly as data properties, and pass to the op the object on which the op was found, not the original receiver. That would make array_length_getter work, but I think it would break other stuff.

You know the story -- bholley is working towards eliminating enough uses of JSPropertyOps that we can do this. Not there yet.

2. It would probably be possible to use JSPROP_SHADOWABLE to mean "this property is really truly a data property, even though it is slotless (JSPROP_SHARED)" and set that bit on the Array length property. Note that we already have this remarkable code in SetExistingProperty:

        if (!shape->shadowable() &&
            !(pobj->is<ArrayObject>() && id == NameToId(cxArg->names().length)))

I'm not going to pursue that right now, though; I really would rather do approach #1, and the sooner the better.