Bug 666599 - Fix ArrayBuffer::obj_lookupProperty. r=mrbkap

js/src/jstypedarray.cpp

@@ -241,8 +241,11 @@ ArrayBuffer::obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
     if (!delegateResult)
         return false;
 
-    if (*propp != NULL)
+    if (*propp != NULL) {
+        if (*objp == delegate)
+            *objp = obj;
         return true;
+    }
 
     JSObject *proto = obj->getProto();
     if (!proto) {

js/src/tests/js1_8_5/regress/jstests.list

@@ -107,3 +107,4 @@ script regress-646820-3.js
 script regress-643222.js
 script regress-614714.js
 script regress-665355.js
+script regress-666599.js

js/src/tests/js1_8_5/regress/regress-666599.js

@@ -0,0 +1,15 @@
+var o1 = {};
+var o2 = new ArrayBuffer();
+o2.__defineGetter__('x', function() {return 42;})
+o1.__proto__ = o2
+assertEq(o1['x'], 42);
+
+var t1 = {};
+var t2 = new ArrayBuffer();
+var t3 = new ArrayBuffer();
+t3.__defineGetter__('x', function() {return 42;})
+t2.__proto__ = t3;
+t1.__proto__ = t2;
+assertEq(t1['x'], 42);
+
+reportCompare(true, true);