Proxy doesn't play well with array_length_getter

RESOLVED DUPLICATE of bug 895223

Status

()

RESOLVED DUPLICATE of bug 895223
4 years ago
4 years ago

People

(Reporter: evilpie, Unassigned)

Tracking

Trunk
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

4 years ago
Because array_length_getter doesn't expect a Proxy object as "this", we always get a length of 0 for proxies with an array target.

var p = new Proxy(['a', 'b'], {})
p.length >> 0

JSON.stringify(new Proxy(['a', 'b'], {})) >> "[]"
Yeah, my current work doesn't fix this.

1. One fix here is to treat properties with JSPropertyOp getters strictly as data properties, and pass to the op the object on which the op was found, not the original receiver. That would make array_length_getter work, but I think it would break other stuff.

You know the story -- bholley is working towards eliminating enough uses of JSPropertyOps that we can do this. Not there yet.

2. It would probably be possible to use JSPROP_SHADOWABLE to mean "this property is really truly a data property, even though it is slotless (JSPROP_SHARED)" and set that bit on the Array length property. Note that we already have this remarkable code in SetExistingProperty:

        if (!shape->shadowable() &&
            !(pobj->is<ArrayObject>() && id == NameToId(cxArg->names().length)))

I'm not going to pursue that right now, though; I really would rather do approach #1, and the sooner the better.
(Reporter)

Updated

4 years ago
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 895223

Updated

4 years ago
Duplicate of this bug: 1136473
You need to log in before you can comment on or make changes to this bug.