need marshal in JavascriptProxy::GetValueFromDescriptor

leirocks · leirocks · commit 764e9787da99 · 2016-12-12T22:00:57.000-08:00
my change chakra-core@6aa7967 revealed this bug
diff --git a/lib/Runtime/Library/JavascriptProxy.cpp b/lib/Runtime/Library/JavascriptProxy.cpp
@@ -1855,7 +1855,7 @@ namespace Js
     {
         if (propertyDescriptor.ValueSpecified())
         {
-            return propertyDescriptor.GetValue();
+            return CrossSite::MarshalVar(requestContext, propertyDescriptor.GetValue());
         }
         if (propertyDescriptor.GetterSpecified())
         {
diff --git a/test/es6/proxybug.js b/test/es6/proxybug.js
@@ -2,6 +2,9 @@
 // Copyright (C) Microsoft. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
+
+var passed;
+
 var func3 = function () 
 {
   var sc4 = WScript.LoadScript('function test(){ obj2.prop4 = {needMarshal:true}; }', 'samethread');
@@ -17,8 +20,36 @@ func3();
 
 var bug = new Proxy(new Array(1), {has: () => true});
 var a = bug.concat();
-if (a[0] !== undefined || a.length !== 1) {
-    print("failed");
+if(a[0] !== undefined || a.length !== 1) {
+    passed = "failed";
 } else {
-    print("passed");
+    passed = "passed";
+}
+
+function test0() {
+  var obj1 = {};
+  var arrObj0 = {};
+  var x=1
+  var proxyHandler = {};
+  proxyHandler['get'] = function () {};
+  proxyHandler['defineProperty'] = function (target, property, descriptor) {    
+    return Reflect.defineProperty(target, property, descriptor);
+  };
+  proxyHandler['isExtensible'] = function (target) {  
+    arrObj0.prop0;
+    arrObj0 = new Proxy(arrObj0, proxyHandler);
+    return Reflect.isExtensible(target);
+  };
+  arrObj0 = new Proxy(arrObj0, proxyHandler);
+  arrObj0 = new Proxy(arrObj0, proxyHandler);
+  do {
+    var sc3 = WScript.LoadScript('function test(){arrObj0.length = arrObj0[obj1];}', 'samethread');
+    sc3.obj1 = obj1;
+    sc3.arrObj0 = arrObj0;
+    sc3.test();
+  } while (x--);
 }
+test0();
+
+
+print(passed);

Original file line number	Diff line number	Diff line change
`@@ -1855,7 +1855,7 @@ namespace Js`
`1855`	`1855`	`{`
`1856`	`1856`	`if (propertyDescriptor.ValueSpecified())`
`1857`	`1857`	`{`
`1858`		`- return propertyDescriptor.GetValue();`
	`1858`	`+ return CrossSite::MarshalVar(requestContext, propertyDescriptor.GetValue());`
`1859`	`1859`	`}`
`1860`	`1860`	`if (propertyDescriptor.GetterSpecified())`
`1861`	`1861`	`{`