Bug 780542. Make construction via a function proxy with an object in the constructor slot actually construct instead of just calling. r=ejpbruel

js/src/jit-test/tests/basic/testProxyConstructors.js

@@ -1,15 +1,23 @@
 // |jit-test| error: ExitCleanly
 
-// proxies can return primitives
-assertEq(new (Proxy.createFunction({}, function(){}, function(){})), undefined);
-x = Proxy.createFunction((function () {}), Uint16Array, wrap)
-new(wrap(x))
+assertEq((new (Proxy.createFunction({},
+                                    function(){ this.x = 1 },
+                                    function(){ this.x = 2 }))).x, 2);
+try {
+    x = Proxy.createFunction((function () {}), Uint16Array, wrap)
+    new(wrap(x))
+    throw "Should not be reached"
+}
+catch (e) {
+    assertEq(String(e.message).indexOf('is not a constructor') === -1, false);
+}
 // proxies can return the callee
 var x = Proxy.createFunction({}, function (q) { return q; });
 assertEq(new x(x), x);
 try {
     var x = (Proxy.createFunction({}, "".indexOf));
     new x;
+    throw "Should not be reached"
 }
 catch (e) {
     assertEq(String(e.message).indexOf('is not a constructor') === -1, false);

js/src/jsproxy.cpp

@@ -474,8 +474,8 @@ IndirectProxyHandler::construct(JSContext *cx, JSObject *proxy, unsigned argc,
     JS_ASSERT(OperationInProgress(cx, proxy));
     Value fval = GetConstruct(proxy);
     if (fval.isUndefined())
-        return InvokeConstructor(cx, GetCall(proxy), argc, argv, rval);
-    return Invoke(cx, UndefinedValue(), fval, argc, argv, rval);
+        fval = GetCall(proxy);
+    return InvokeConstructor(cx, fval, argc, argv, rval);
 }
 
 bool

js/xpconnect/tests/chrome/test_bug771429.xul

@@ -21,6 +21,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=771429
       function f() {}
       function g() { return this; }
       function h() { "use strict"; return this; }
+      function ctor() { this.x = 1; }
       f.x = 2;
       f.g = g;
       var Cu = Components.utils;
@@ -40,6 +41,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=771429
         // on g instead of whatever our proxies happen to return.
         is(Cu.evalInSandbox('var x = { z: 7 }; Function.prototype.call.call(g, x).z', s), 7,
            "Should not rebind calls that are already bound");
+        is(Cu.evalInSandbox('new ctor();', s).x, 1,
+           "Should get a properly constructed object out of the sandbox");
       } catch (e) {
         ok(false, "Should not get an exception: " + e);
       }