Bug 1090636, part 11 - Pass pobj (the object that contains the element) to SetDenseOrTypedArrayElement rather than obj. Reflect.set could trigger the bug being fixed here, so we leave a sleeper test for it. r=efaust.

--HG--
extra : rebase_source : 712fb4a4ffd98c0c3e6ba10b3c7dd7bfe8d497f5

js/src/tests/ecma_6/Reflect/set.js

@@ -0,0 +1,16 @@
+if (this.Reflect && Reflect.set)
+    throw new Error("Congrats on implementing Reflect.set! Uncomment this test for 1 karma point.");
+
+/*
+// Per spec, this should first call p.[[Set]]("0", 42, a) and
+// then (since p has no own properties) a.[[Set]]("0", 42, a).
+// Obviously the latter should not define a property on p.
+
+var a = [0, 1, 2, 3];
+var p = Object.create(a);
+Reflect.set(p, "0", 42, a);
+assertEq(p.hasOwnProperty("0"), false);
+assertEq(a[0], 42);
+*/
+
+reportCompare(0, 0, 'ok');

js/src/vm/NativeObject.cpp

@@ -2170,12 +2170,12 @@ template <ExecutionMode mode>
 static bool
 SetExistingProperty(typename ExecutionModeTraits<mode>::ContextType cxArg,
                     HandleNativeObject obj, HandleObject receiver, HandleId id,
-                    HandleObject pobj, HandleShape shape, MutableHandleValue vp, bool strict)
+                    HandleNativeObject pobj, HandleShape shape, MutableHandleValue vp, bool strict)
 {
     if (IsImplicitDenseOrTypedArrayElement(shape)) {
         /* ES5 8.12.4 [[Put]] step 2, for a dense data property on pobj. */
         if (pobj == receiver)
-            return SetDenseOrTypedArrayElement<mode>(cxArg, obj, JSID_TO_INT(id), vp, strict);
+            return SetDenseOrTypedArrayElement<mode>(cxArg, pobj, JSID_TO_INT(id), vp, strict);
     } else {
         /* ES5 8.12.4 [[Put]] step 2. */
         if (shape->isAccessorDescriptor()) {
@@ -2270,8 +2270,10 @@ baseops::SetPropertyHelper(typename ExecutionModeTraits<mode>::ContextType cxArg
     if (!shape)
         return SetNonexistentProperty<mode>(cxArg, receiver, id, qualified, vp, strict);
 
-    if (pobj->isNative())
-        return SetExistingProperty<mode>(cxArg, obj, receiver, id, pobj, shape, vp, strict);
+    if (pobj->isNative()) {
+        RootedNativeObject nativePObj(cxArg, &pobj->as<NativeObject>());
+        return SetExistingProperty<mode>(cxArg, obj, receiver, id, nativePObj, shape, vp, strict);
+    }
 
     if (pobj->is<ProxyObject>()) {
         if (mode == ParallelExecution)