Bug 1506861 - Stop accessing Proxy.prototype in XrayWrapper r=bholley

Differential Revision: https://phabricator.services.mozilla.com/D11771

--HG--
extra : moz-landing-system : lando

js/xpconnect/tests/chrome/test_xrayToJS.xul

@@ -152,6 +152,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=933681
 
     testSet();
 
+    testProxy();
+
     testDataView();
 
     testNumber();
@@ -983,6 +985,17 @@ for (var prop of props) {
     is(t.size, 0, "Set is empty after calling clear");
   }
 
+  function testProxy() {
+    let ProxyCtor = iwin.Proxy;
+    is(Object.getOwnPropertyNames(ProxyCtor).sort().toSource(),
+       ["length", "name"].sort().toSource(),
+       "Xrayed Proxy constructor should not have any properties");
+    is(ProxyCtor.prototype, undefined, "Proxy.prototype should not be set");
+    // Proxy.revocable can safely be exposed, but it is not.
+    // Until it is supported, check that the property is not set.
+    is(ProxyCtor.revocable, undefined, "Proxy.reflect is not set");
+  }
+
   function testDataView() {
     testXray('DataView', new iwin.DataView(new iwin.ArrayBuffer(4)),
              new iwin.DataView(new iwin.ArrayBuffer(8)));

js/xpconnect/wrappers/XrayWrapper.cpp

@@ -485,6 +485,12 @@ TryResolvePropertyFromSpecs(JSContext* cx, HandleId id, HandleObject holder,
     return true;
 }
 
+static bool
+ShouldResolvePrototypeProperty(JSProtoKey key) {
+    // Proxy constructors have no "prototype" property.
+    return key != JSProto_Proxy;
+}
+
 static bool
 ShouldResolveStaticProperties(JSProtoKey key)
 {
@@ -593,7 +599,8 @@ JSXrayTraits::resolveOwnProperty(JSContext* cx, HandleObject wrapper,
                 if (standardConstructor != JSProto_Null) {
                     // Handle the 'prototype' property to make
                     // xrayedGlobal.StandardClass.prototype work.
-                    if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE)) {
+                    if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE) &&
+                        ShouldResolvePrototypeProperty(standardConstructor)) {
                         RootedObject standardProto(cx);
                         {
                             JSAutoRealm ar(cx, target);
@@ -929,8 +936,10 @@ JSXrayTraits::enumerateNames(JSContext* cx, HandleObject wrapper, unsigned flags
             // constructors.
             JSProtoKey standardConstructor = constructorFor(holder);
             if (standardConstructor != JSProto_Null) {
-                if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE))) {
-                    return false;
+                if (ShouldResolvePrototypeProperty(standardConstructor)) {
+                    if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE))) {
+                        return false;
+                    }
                 }
 
                 if (ShouldResolveStaticProperties(standardConstructor)) {