Line 176 of jsreflect.cpp uses baseops::GetPropertyDefault to get the handlers from the builder object when provided to Reflect.parse as an option. This makes it so that a Scripted Proxy can't be used as the builder object, and I've also been told it is very bad mojo to be using GetPropertyDefault here.
Actually, GetPropertyDefault is used in 5 places in jsreflect.cpp and I assume these all should be replaced.
Summary: Reflect.parse uses baseops::GetPropertyDefault → jsreflect.cpp uses baseops::GetPropertyDefault
Attachment #790989 - Flags: review?(bhackett1024) → review+
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in before you can comment on or make changes to this bug.