getElementIfPresent ends up invoking non-own |has| trap on proxy with hasPrototype()

RESOLVED FIXED in mozilla18

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: bholley, Assigned: bholley)

Tracking

(Blocks: 1 bug)

unspecified
mozilla18
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t])

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
We assert in DirectWrapper that we're only invoking own traps on the object if hasPrototype() is true. But the implementation getElementIfPresent in BaseProxyHandler calls has(), which violates this assumption. This causes us to assert. Patch coming right up.
(Assignee)

Comment 1

6 years ago
Created attachment 652959 [details] [diff] [review]
Call through to get() for hasPrototype() path in getElementIfPresent(). v1
Attachment #652959 - Flags: review?(ejpbruel)
Whiteboard: [js:t]

Updated

6 years ago
Attachment #652959 - Flags: review+

Updated

6 years ago
Attachment #652959 - Flags: review?(ejpbruel)
(Assignee)

Comment 3

6 years ago
This was partially orange because of the other patch pushed alongside it to try, but I don't see any failures that look related to this patch. Pushing to inbound:

https://hg.mozilla.org/integration/mozilla-inbound/rev/3d8bdbcc40f9
https://hg.mozilla.org/mozilla-central/rev/3d8bdbcc40f9
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
(Assignee)

Comment 5

6 years ago
Test coverage here is possible, but it's not very high on my priority list.
Flags: in-testsuite? → in-testsuite-
You need to log in before you can comment on or make changes to this bug.