From 1015de5f8e1e7536f3572ce65b50f7e17821a84a Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Mon, 20 Oct 2014 13:05:46 -0700
Subject: [PATCH] Bug 1072817 - Implement trivial {get,set}PrototypeOf hooks
 for ScriptedDirectProxyHandler. (r=jorendorff)

---
 js/src/jit-test/tests/proxy/bug1072817.js   |  5 ++++
 js/src/proxy/ScriptedDirectProxyHandler.cpp | 29 +++++++++++++++++++++
 js/src/proxy/ScriptedDirectProxyHandler.h   |  5 ++++
 3 files changed, 39 insertions(+)
 create mode 100644 js/src/jit-test/tests/proxy/bug1072817.js

diff --git a/js/src/jit-test/tests/proxy/bug1072817.js b/js/src/jit-test/tests/proxy/bug1072817.js
new file mode 100644
index 000000000000..d8656e0c7094
--- /dev/null
+++ b/js/src/jit-test/tests/proxy/bug1072817.js
@@ -0,0 +1,5 @@
+// |jit-test| error: TypeError
+var r = Proxy.revocable({}, {});
+var p = r.proxy;
+r.revoke();
+p instanceof Object;
diff --git a/js/src/proxy/ScriptedDirectProxyHandler.cpp b/js/src/proxy/ScriptedDirectProxyHandler.cpp
index 31c74655cb13..1a3ba0c520d0 100644
--- a/js/src/proxy/ScriptedDirectProxyHandler.cpp
+++ b/js/src/proxy/ScriptedDirectProxyHandler.cpp
@@ -1090,6 +1090,35 @@ ScriptedDirectProxyHandler::isCallable(JSObject *obj) const
     return obj->as<ProxyObject>().extra(IS_CALLABLE_EXTRA).toBoolean();
 }
 
+// ES6 implements both getPrototypeOf and setPrototypeOf traps. We don't have them yet (see bug
+// 888969). For now, use these, to account for proxy revocation.
+bool
+ScriptedDirectProxyHandler::getPrototypeOf(JSContext *cx, HandleObject proxy,
+                                           MutableHandleObject protop) const
+{
+    RootedObject target(cx, proxy->as<ProxyObject>().target());
+    // Though handler is used elsewhere, spec mandates that both get set to null.
+    if (!target) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_PROXY_REVOKED);
+        return false;
+    }
+
+    return DirectProxyHandler::getPrototypeOf(cx, proxy, protop);
+}
+
+bool
+ScriptedDirectProxyHandler::setPrototypeOf(JSContext *cx, HandleObject proxy,
+                                           HandleObject proto, bool *bp) const
+{
+    RootedObject target(cx, proxy->as<ProxyObject>().target());
+    if (!target) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_PROXY_REVOKED);
+        return false;
+    }
+
+    return DirectProxyHandler::setPrototypeOf(cx, proxy, proto, bp);
+}
+
 const char ScriptedDirectProxyHandler::family = 0;
 const ScriptedDirectProxyHandler ScriptedDirectProxyHandler::singleton;
 
diff --git a/js/src/proxy/ScriptedDirectProxyHandler.h b/js/src/proxy/ScriptedDirectProxyHandler.h
index 9ad0418229a4..6558a1bef208 100644
--- a/js/src/proxy/ScriptedDirectProxyHandler.h
+++ b/js/src/proxy/ScriptedDirectProxyHandler.h
@@ -36,6 +36,11 @@ class ScriptedDirectProxyHandler : public DirectProxyHandler {
                      bool strict, MutableHandleValue vp) const MOZ_OVERRIDE;
     virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const MOZ_OVERRIDE;
     virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const MOZ_OVERRIDE;
+    // These are standard internal methods, but are not implemented to spec yet.
+    virtual bool getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop)
+        const MOZ_OVERRIDE;
+    virtual bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp)
+        const MOZ_OVERRIDE;
 
     /* SpiderMonkey extensions. */
     virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,