Skip to content

Commit 0ab7db7

Browse files
leirocksleirocks
committed
[MERGE chakra-core#2425 @leirocks] pick two proxy bug fix to release/1.4
Merge pull request chakra-core#2425 from leirocks:proxyBugFixPort Proxy ownkeys trap needs marshal cheery-picked from: 6d7c7ca need marshal in JavascriptProxy::GetValueFromDescriptor my change chakra-core@6aa7967 revealed this bug cheery-picked from master: 764e978
2 parents bf18cec + af48a3f commit 0ab7db7

5 files changed

Lines changed: 54 additions & 11 deletions

File tree

‎lib/Runtime/Language/JavascriptOperators.cpp‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1116,7 +1116,7 @@ namespace Js
11161116
if (JavascriptProxy::Is(instance))
11171117
{
11181118
JavascriptProxy* proxy = JavascriptProxy::FromVar(instance);
1119-
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind);
1119+
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind, scriptContext);
11201120
}
11211121

11221122
return JavascriptObject::CreateOwnStringPropertiesHelper(object, scriptContext);
@@ -1130,7 +1130,7 @@ namespace Js
11301130
if (JavascriptProxy::Is(instance))
11311131
{
11321132
JavascriptProxy* proxy = JavascriptProxy::FromVar(instance);
1133-
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertySymbolKind);
1133+
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertySymbolKind, scriptContext);
11341134
}
11351135

11361136
return JavascriptObject::CreateOwnSymbolPropertiesHelper(object, scriptContext);
@@ -1143,7 +1143,7 @@ namespace Js
11431143
if (JavascriptProxy::Is(instance))
11441144
{
11451145
JavascriptProxy* proxy = JavascriptProxy::FromVar(instance);
1146-
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::KeysKind);
1146+
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::KeysKind, scriptContext);
11471147
}
11481148

11491149
return JavascriptObject::CreateOwnStringSymbolPropertiesHelper(object, scriptContext);
@@ -1156,7 +1156,7 @@ namespace Js
11561156
if (JavascriptProxy::Is(instance))
11571157
{
11581158
JavascriptProxy* proxy = JavascriptProxy::FromVar(instance);
1159-
JavascriptArray* proxyResult = proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind);
1159+
JavascriptArray* proxyResult = proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind, scriptContext);
11601160
JavascriptArray* proxyResultToReturn = scriptContext->GetLibrary()->CreateArray(0);
11611161

11621162
// filter enumerable keys
@@ -1192,7 +1192,7 @@ namespace Js
11921192
if (JavascriptProxy::Is(instance))
11931193
{
11941194
JavascriptProxy* proxy = JavascriptProxy::FromVar(instance);
1195-
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::KeysKind);
1195+
return proxy->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::KeysKind, scriptContext);
11961196
}
11971197
return JavascriptObject::CreateOwnEnumerableStringSymbolPropertiesHelper(object, scriptContext);
11981198
}

‎lib/Runtime/Library/JSON.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -603,7 +603,7 @@ namespace JSON
603603
if (JavascriptProxy::Is(object))
604604
{
605605
JavascriptProxy* proxyObject = JavascriptProxy::FromVar(object);
606-
JavascriptArray* proxyResult = proxyObject->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind);
606+
JavascriptArray* proxyResult = proxyObject->PropertyKeysTrap(JavascriptProxy::KeysTrapKind::GetOwnPropertyNamesKind, this->scriptContext);
607607

608608
// filter enumerable keys
609609
uint32 resultLength = proxyResult->GetLength();

‎lib/Runtime/Library/JavascriptProxy.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1870,7 +1870,7 @@ namespace Js
18701870
{
18711871
if (propertyDescriptor.ValueSpecified())
18721872
{
1873-
return propertyDescriptor.GetValue();
1873+
return CrossSite::MarshalVar(requestContext, propertyDescriptor.GetValue());
18741874
}
18751875
if (propertyDescriptor.GetterSpecified())
18761876
{
@@ -2120,7 +2120,7 @@ namespace Js
21202120
return trapResult;
21212121
}
21222122

2123-
JavascriptArray* JavascriptProxy::PropertyKeysTrap(KeysTrapKind keysTrapKind)
2123+
JavascriptArray* JavascriptProxy::PropertyKeysTrap(KeysTrapKind keysTrapKind, ScriptContext* requestContext)
21242124
{
21252125
PROBE_STACK(GetScriptContext(), Js::Constants::MinStackDefault);
21262126

@@ -2149,7 +2149,7 @@ namespace Js
21492149
//6. ReturnIfAbrupt(trap).
21502150
//7. If trap is undefined, then
21512151
// a. Return target.[[OwnPropertyKeys]]().
2152-
JavascriptFunction* ownKeysMethod = GetMethodHelper(PropertyIds::ownKeys, scriptContext);
2152+
JavascriptFunction* ownKeysMethod = GetMethodHelper(PropertyIds::ownKeys, requestContext);
21532153
Assert(!GetScriptContext()->IsHeapEnumInProgress());
21542154

21552155
JavascriptArray *targetKeys;

‎lib/Runtime/Library/JavascriptProxy.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ namespace Js
156156

157157
void PropertyIdFromInt(uint32 index, PropertyRecord const** propertyRecord);
158158

159-
JavascriptArray* PropertyKeysTrap(KeysTrapKind keysTrapKind);
159+
JavascriptArray* PropertyKeysTrap(KeysTrapKind keysTrapKind, ScriptContext* requestContext);
160160

161161
template <class Fn>
162162
void GetOwnPropertyKeysHelper(ScriptContext* scriptContext, RecyclableObject* trapResultArray, uint32 len, JavascriptArray* trapResult,

‎test/es6/proxy_cctx_bugs.js‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,5 +51,48 @@ function test2() {
5151
sc9_cctx.test();
5252
}
5353

54+
function test3() {
55+
var obj1 = {};
56+
var arrObj0 = {};
57+
var x=1
58+
var proxyHandler = {};
59+
proxyHandler['get'] = function () {};
60+
proxyHandler['defineProperty'] = function (target, property, descriptor) {
61+
return Reflect.defineProperty(target, property, descriptor);
62+
};
63+
proxyHandler['isExtensible'] = function (target) {
64+
arrObj0.prop0;
65+
arrObj0 = new Proxy(arrObj0, proxyHandler);
66+
return Reflect.isExtensible(target);
67+
};
68+
arrObj0 = new Proxy(arrObj0, proxyHandler);
69+
arrObj0 = new Proxy(arrObj0, proxyHandler);
70+
do {
71+
var sc3 = WScript.LoadScript('function test(){arrObj0.length = arrObj0[obj1];}', 'samethread');
72+
sc3.obj1 = obj1;
73+
sc3.arrObj0 = arrObj0;
74+
sc3.test();
75+
} while (x--);
76+
}
77+
78+
function test4() {
79+
var func3 = function () { };
80+
var ary = Array();
81+
var proxyHandler = {};
82+
var ownkeys = Reflect.ownKeys(ary);
83+
proxyHandler['ownKeys'] = function () {
84+
func3() == 0;
85+
return ownkeys;
86+
};
87+
88+
ary = new Proxy(ary, proxyHandler);
89+
var sc2 = WScript.LoadScript('function test(){for (var x in ary);}', 'samethread');
90+
sc2.ary = ary;
91+
sc2.func3 = func3;
92+
sc2.test();
93+
}
94+
5495
test1();
55-
test2();
96+
test2();
97+
test3();
98+
test4();

0 commit comments

Comments
 (0)