Bug 987111 - Fill out existing_desc with all properties, not just |own| ones. r=gabor
☠☠ backed out by fe14647a422d ☠ ☠
authorBobby Holley <bobbyholley@gmail.com>
Wed, 04 Jun 2014 15:12:26 -0700
changeset 205921 e7b7548867d998b0e6a9e534860cac5506314a7d
parent 205920 944d128f135aeebe1d91d940f5ad1d81917db58f
child 205922 0a4d18d6306f5bccae307ad6edf1ca47e799b0c9
push id3741
push userasasaki@mozilla.com
push dateMon, 21 Jul 2014 20:25:18 +0000
treeherdermozilla-beta@4d6f46f5af68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersgabor
bugs987111
milestone32.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 987111 - Fill out existing_desc with all properties, not just |own| ones. r=gabor This gives us strictly more information than we had before, which turns out to be useful. We can still get the old behavior by testing the identity of desc.object(), which I've done in one of the two existing uses for existing_desc. The other (in DOMXrayTraits::defineProperty) is actually more correct with the full (non-own) lookup.
js/xpconnect/wrappers/XrayWrapper.cpp
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2037,20 +2037,26 @@ RecreateLostWaivers(JSContext *cx, JSPro
 template <typename Base, typename Traits>
 bool
 XrayWrapper<Base, Traits>::defineProperty(JSContext *cx, HandleObject wrapper,
                                           HandleId id, MutableHandle<JSPropertyDescriptor> desc)
 {
     assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::SET);
 
     Rooted<JSPropertyDescriptor> existing_desc(cx);
-    if (!getOwnPropertyDescriptor(cx, wrapper, id, &existing_desc))
+    if (!JS_GetPropertyDescriptorById(cx, wrapper, id, &existing_desc))
         return false;
 
-    if (existing_desc.object() && existing_desc.isPermanent())
+    // Note that the check here is intended to differentiate between own and
+    // non-own properties, since the above lookup is not limited to own
+    // properties. At present, this may not always do the right thing because
+    // we often lie (sloppily) about where we found properties and set
+    // desc.object() to |wrapper|. Once we fully fix our Xray prototype semantics,
+    // this should work as intended.
+    if (existing_desc.object() == wrapper && existing_desc.isPermanent())
         return true; // silently ignore attempt to overwrite native property
 
     bool defined = false;
     if (!Traits::defineProperty(cx, wrapper, id, desc, existing_desc, &defined))
         return false;
     if (defined)
         return true;