Skip to content

Commit e0012ee

Browse files
dilijevdilijev
committed
Fix 7019631: Check whether a Proxy object is anywhere in the prototype chain before choosing to do the optimized ToPropertyDescriptor for non-Proxy objects.
1 parent 47a01f9 commit e0012ee

5 files changed

Lines changed: 78 additions & 4 deletions

File tree

‎lib/Runtime/Language/JavascriptOperators.cpp‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8670,6 +8670,7 @@ namespace Js
86708670

86718671
return true;
86728672
}
8673+
86738674
BOOL JavascriptOperators::ToPropertyDescriptorForProxyObjects(Var propertySpec, PropertyDescriptor* descriptor, ScriptContext* scriptContext)
86748675
{
86758676
if (!JavascriptOperators::IsObject(propertySpec))
@@ -8815,7 +8816,8 @@ namespace Js
88158816

88168817
BOOL JavascriptOperators::ToPropertyDescriptor(Var propertySpec, PropertyDescriptor* descriptor, ScriptContext* scriptContext)
88178818
{
8818-
if (JavascriptProxy::Is(propertySpec))
8819+
if (JavascriptProxy::Is(propertySpec) ||
8820+
JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject::FromVar(propertySpec)->GetPrototype()))
88198821
{
88208822
if (ToPropertyDescriptorForProxyObjects(propertySpec, descriptor, scriptContext) == FALSE)
88218823
{
@@ -9953,16 +9955,13 @@ namespace Js
99539955
return !Equal(aLeft, aRight, scriptContext);
99549956
}
99559957

9956-
99579958
// NotStrictEqual() returns whether the two vars have strict equality, as
99589959
// described in (ES3.0: S11.9.5, S11.9.6).
9959-
99609960
BOOL JavascriptOperators::NotStrictEqual(Var aLeft, Var aRight, ScriptContext* scriptContext)
99619961
{
99629962
return !StrictEqual(aLeft, aRight, scriptContext);
99639963
}
99649964

9965-
99669965
bool JavascriptOperators::CheckIfObjectAndPrototypeChainHasOnlyWritableDataProperties(RecyclableObject* object)
99679966
{
99689967
Assert(object);
@@ -10033,6 +10032,24 @@ namespace Js
1003310032
return true;
1003410033
}
1003510034

10035+
bool JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject* prototype)
10036+
{
10037+
Assert(JavascriptOperators::IsObjectOrNull(prototype));
10038+
10039+
if (prototype->GetTypeId() == TypeIds_Null)
10040+
{
10041+
return false;
10042+
}
10043+
else if (prototype->GetTypeId() == TypeIds_Proxy)
10044+
{
10045+
return true;
10046+
}
10047+
else
10048+
{
10049+
return CheckIfPrototypeChainContainsProxyObject(prototype->GetPrototype());
10050+
}
10051+
}
10052+
1003610053
BOOL JavascriptOperators::Equal(Var aLeft, Var aRight, ScriptContext* scriptContext)
1003710054
{
1003810055
if (aLeft == aRight)

‎lib/Runtime/Language/JavascriptOperators.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -538,6 +538,7 @@ namespace Js
538538
static bool CheckIfObjectAndPrototypeChainHasOnlyWritableDataProperties(RecyclableObject* object);
539539
static bool CheckIfPrototypeChainHasOnlyWritableDataProperties(RecyclableObject* prototype);
540540
static bool DoCheckIfPrototypeChainHasOnlyWritableDataProperties(RecyclableObject* prototype);
541+
static bool CheckIfPrototypeChainContainsProxyObject(RecyclableObject* prototype);
541542
static void OP_SetComputedNameVar(Var method, Var computedNameVar);
542543
static void OP_SetHomeObj(Var method, Var homeObj);
543544
static Var OP_LdSuper(Var scriptFunction, ScriptContext * scriptContext);

‎test/es6/proxyprotobug.baseline‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
has enumerable
2+
get enumerable
3+
has configurable
4+
get configurable
5+
has value
6+
get value
7+
has writable
8+
get writable
9+
has get
10+
has set
11+
======================
12+
has enumerable
13+
get enumerable
14+
has configurable
15+
get configurable
16+
has value
17+
get value
18+
has writable
19+
get writable
20+
has get
21+
has set

‎test/es6/proxyprotobug.js‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
//-------------------------------------------------------------------------------------------------------
2+
// Copyright (C) Microsoft. All rights reserved.
3+
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
4+
//-------------------------------------------------------------------------------------------------------
5+
6+
var proxyHandler = {
7+
has(p, n) {
8+
WScript.Echo("has " + n);
9+
return !(n === "get" || n === "set");
10+
},
11+
get(p, n) {
12+
WScript.Echo("get " + n);
13+
if (n == "get" || n == "set") {
14+
return () => 1;
15+
} else {
16+
return 1;
17+
}
18+
}
19+
};
20+
21+
var p = new Proxy({}, proxyHandler);
22+
var o = {};
23+
Object.defineProperty(o, "x", p);
24+
25+
WScript.Echo("======================");
26+
27+
var pp = {};
28+
pp.__proto__ = p;
29+
Object.defineProperty(o, "y", pp);

‎test/es6/rlexe.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -682,6 +682,12 @@
682682
<files>proxybug3.js</files>
683683
</default>
684684
</test>
685+
<test>
686+
<default>
687+
<files>proxyprotobug.js</files>
688+
<baseline>proxyprotobug.baseline</baseline>
689+
</default>
690+
</test>
685691
<test>
686692
<default>
687693
<files>proxyenumbug.js</files>

0 commit comments

Comments
 (0)