need marshal in JavascriptProxy::GetValueFromDescriptor

leirocks · leirocks · commit 712f1f940af3 · 2017-01-27T15:38:21.000-08:00
my change chakra-core@6aa7967 revealed this bug cheery-picked from master: 764e978
diff --git a/lib/Runtime/Library/JavascriptProxy.cpp b/lib/Runtime/Library/JavascriptProxy.cpp
@@ -1870,7 +1870,7 @@ namespace Js
     {
         if (propertyDescriptor.ValueSpecified())
         {
-            return propertyDescriptor.GetValue();
+            return CrossSite::MarshalVar(requestContext, propertyDescriptor.GetValue());
         }
         if (propertyDescriptor.GetterSpecified())
         {
diff --git a/test/es6/proxy_cctx_bugs.js b/test/es6/proxy_cctx_bugs.js
@@ -51,5 +51,30 @@ function test2() {
   sc9_cctx.test();
 }
 
+function test3() {
+  var obj1 = {};
+  var arrObj0 = {};
+  var x=1
+  var proxyHandler = {};
+  proxyHandler['get'] = function () {};
+  proxyHandler['defineProperty'] = function (target, property, descriptor) {    
+    return Reflect.defineProperty(target, property, descriptor);
+  };
+  proxyHandler['isExtensible'] = function (target) {  
+    arrObj0.prop0;
+    arrObj0 = new Proxy(arrObj0, proxyHandler);
+    return Reflect.isExtensible(target);
+  };
+  arrObj0 = new Proxy(arrObj0, proxyHandler);
+  arrObj0 = new Proxy(arrObj0, proxyHandler);
+  do {
+    var sc3 = WScript.LoadScript('function test(){arrObj0.length = arrObj0[obj1];}', 'samethread');
+    sc3.obj1 = obj1;
+    sc3.arrObj0 = arrObj0;
+    sc3.test();
+  } while (x--);
+}
+
 test1();
-test2();
+test2();
+test3();

Original file line number	Diff line number	Diff line change
`@@ -1870,7 +1870,7 @@ namespace Js`
`1870`	`1870`	`{`
`1871`	`1871`	`if (propertyDescriptor.ValueSpecified())`
`1872`	`1872`	`{`
`1873`		`- return propertyDescriptor.GetValue();`
	`1873`	`+ return CrossSite::MarshalVar(requestContext, propertyDescriptor.GetValue());`
`1874`	`1874`	`}`
`1875`	`1875`	`if (propertyDescriptor.GetterSpecified())`
`1876`	`1876`	`{`