Fix the regressions introduced by rev af9974df716c (bug 665214).
authorJason Orendorff <jorendorff@mozilla.com>
Wed, 13 Jul 2011 14:03:36 -0500
changeset 75206 87fcbd9379482902399c39438b759a49e12ae9cc
parent 75205 1d1952d5674ccf8516ee36d884a47bd3b9084043
child 75207 3b78b884c2c024586141c6f44f7fdb3c1e11e198
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs665214
milestone8.0a1
Fix the regressions introduced by rev af9974df716c (bug 665214). 1. Fix an embarrassing bug in NewPropertyDescriptorObject. 2. Fix a similar embarrassing bug in GetOwnPropertyDescriptor. 3. An existing jit-test required some seriously buggy Proxy behavior. (It's a "don't crash" fuzztest.) Rev af9974df716c accidentally fixed the buggy Proxy behavior, causing the test to fail. Keep the fix and update the test.
js/src/jit-test/tests/basic/testProxyDefinePropertyWithMissingSetter.js
js/src/jsobj.cpp
--- a/js/src/jit-test/tests/basic/testProxyDefinePropertyWithMissingSetter.js
+++ b/js/src/jit-test/tests/basic/testProxyDefinePropertyWithMissingSetter.js
@@ -1,11 +1,10 @@
 // throw, don't crash
 
-var expect = "TypeError: property descriptor's setter field is neither undefined nor a function";
 var actual = "";
 
 try {
 
 (x = Proxy.createFunction((function() {
   return {
     defineProperty: function(name, desc) {
       Object.defineProperty(x, name, desc)
@@ -15,9 +14,9 @@ try {
 Object.defineProperty(x, "", ({
   get: function() {}
 }))
 
 } catch (e) {
     actual = '' + e;
 }
 
-assertEq(expect, actual);
+assertEq(actual, "InternalError: too much recursion");
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1725,18 +1725,22 @@ namespace js {
 bool
 NewPropertyDescriptorObject(JSContext *cx, const PropertyDescriptor *desc, Value *vp)
 {
     if (!desc->obj) {
         vp->setUndefined();
         return true;
     }
     uintN attrs = desc->attrs;
-    Value getter = (attrs & JSPROP_GETTER) ? CastAsObjectJsval(desc->getter) : UndefinedValue();
-    Value setter = (attrs & JSPROP_SETTER) ? CastAsObjectJsval(desc->setter) : UndefinedValue();
+    Value getter = ((attrs & JSPROP_GETTER) && desc->getter)
+                   ? CastAsObjectJsval(desc->getter)
+                   : UndefinedValue();
+    Value setter = ((attrs & JSPROP_SETTER) && desc->setter)
+                   ? CastAsObjectJsval(desc->setter)
+                   : UndefinedValue();
 
     /* We have our own property, so start creating the descriptor. */
     JSObject *obj = NewBuiltinClassInstance(cx, &js_ObjectClass);
     if (!obj)
         return false;
 
     const JSAtomState &atomState = cx->runtime->atomState;
     if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
@@ -1786,19 +1790,19 @@ GetOwnPropertyDescriptor(JSContext *cx, 
 
     bool doGet = true;
     if (pobj->isNative()) {
         Shape *shape = (Shape *) prop;
         desc->attrs = shape->attributes();
         if (desc->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
             doGet = false;
             if (desc->attrs & JSPROP_GETTER)
-                desc->getter = CastAsPropertyOp(shape->getterValue().toObjectOrNull());
+                desc->getter = CastAsPropertyOp(shape->getterObject());
             if (desc->attrs & JSPROP_SETTER)
-                desc->setter = CastAsStrictPropertyOp(shape->setterValue().toObjectOrNull());
+                desc->setter = CastAsStrictPropertyOp(shape->setterObject());
         }
     } else {
         if (!pobj->getAttributes(cx, id, &desc->attrs))
             return false;
     }
 
     if (doGet && !obj->getProperty(cx, id, &desc->value))
         return false;