<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197136] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197136">197136</a></dd>
<dt>Author</dt> <dd>sbarati@apple.com</dd>
<dt>Date</dt> <dd>2016-02-25 14:58:23 -0800 (Thu, 25 Feb 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>[ES6] Implement Proxy.[[Set]]
https://bugs.webkit.org/show_bug.cgi?id=154511

Reviewed by Filip Pizlo.

This patch is mostly an implementation of
Proxy.[[Set]] with respect to section 9.5.9
of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver

This patch also changes JSObject::putInline and JSObject::putByIndex
to be aware that a Proxy in the prototype chain will intercept
property accesses.

* runtime/JSObject.cpp:
(JSC::JSObject::putInlineSlow):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
* runtime/JSObject.h:
* runtime/JSObjectInlines.h:
(JSC::JSObject::canPerformFastPutInline):
(JSC::JSObject::putInline):
* runtime/JSType.h:
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::put):
(JSC::ProxyObject::putByIndexCommon):
(JSC::ProxyObject::putByIndex):
(JSC::performProxyCall):
(JSC::ProxyObject::getCallData):
(JSC::performProxyConstruct):
(JSC::ProxyObject::deletePropertyByIndex):
(JSC::ProxyObject::visitChildren):
* runtime/ProxyObject.h:
(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):
(JSC::ProxyObject::target):
(JSC::ProxyObject::handler):
* tests/es6.yaml:
* tests/stress/proxy-set.js: Added.
(assert):
(throw.new.Error.let.handler.set 45):
(throw.new.Error):
(let.target.set x):
(let.target.get x):
(set let):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectInlinesh">trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeh">trunk/Source/JavaScriptCore/runtime/JSType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjecth">trunk/Source/JavaScriptCore/runtime/ProxyObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestses6yaml">trunk/Source/JavaScriptCore/tests/es6.yaml</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressproxysetjs">trunk/Source/JavaScriptCore/tests/stress/proxy-set.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -1,3 +1,52 @@
</span><ins>+2016-02-25  Saam barati  &lt;sbarati@apple.com&gt;
+
+        [ES6] Implement Proxy.[[Set]]
+        https://bugs.webkit.org/show_bug.cgi?id=154511
+
+        Reviewed by Filip Pizlo.
+
+        This patch is mostly an implementation of
+        Proxy.[[Set]] with respect to section 9.5.9
+        of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
+
+        This patch also changes JSObject::putInline and JSObject::putByIndex
+        to be aware that a Proxy in the prototype chain will intercept
+        property accesses.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        (JSC::JSObject::putInline):
+        * runtime/JSType.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::put):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::ProxyObject::putByIndex):
+        (JSC::performProxyCall):
+        (JSC::ProxyObject::getCallData):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::deletePropertyByIndex):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        (JSC::ProxyObject::target):
+        (JSC::ProxyObject::handler):
+        * tests/es6.yaml:
+        * tests/stress/proxy-set.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.set 45):
+        (throw.new.Error):
+        (let.target.set x):
+        (let.target.get x):
+        (set let):
+
</ins><span class="cx"> 2016-02-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [JSC] Remove a useless &quot;Move&quot; in the lowering of Select
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -422,6 +422,11 @@
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx">         }
</span><ins>+        if (obj-&gt;type() == ProxyObjectType) {
+            ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(obj);
+            proxy-&gt;ProxyObject::put(proxy, exec, propertyName, value, slot);
+            return;
+        }
</ins><span class="cx">         JSValue prototype = obj-&gt;prototype();
</span><span class="cx">         if (prototype.isNull())
</span><span class="cx">             break;
</span><span class="lines">@@ -1916,6 +1921,12 @@
</span><span class="cx">                 return true;
</span><span class="cx">             }
</span><span class="cx">         }
</span><ins>+
+        if (current-&gt;type() == ProxyObjectType) {
+            ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(current);
+            proxy-&gt;putByIndexCommon(exec, thisValue, i, value, shouldThrow);
+            return true;
+        }
</ins><span class="cx">         
</span><span class="cx">         JSValue prototypeValue = current-&gt;prototype();
</span><span class="cx">         if (prototypeValue.isNull())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -855,6 +855,7 @@
</span><span class="cx">         
</span><span class="cx">     template&lt;PutMode&gt;
</span><span class="cx">     bool putDirectInternal(VM&amp;, PropertyName, JSValue, unsigned attr, PutPropertySlot&amp;);
</span><ins>+    bool canPerformFastPutInline(ExecState* exec, VM&amp;, PropertyName);
</ins><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE NEVER_INLINE void putInlineSlow(ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -30,6 +30,28 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+ALWAYS_INLINE bool JSObject::canPerformFastPutInline(ExecState* exec, VM&amp; vm, PropertyName propertyName)
+{
+    if (UNLIKELY(propertyName == exec-&gt;propertyNames().underscoreProto))
+        return false;
+
+    // Check if there are any setters or getters in the prototype chain
+    JSValue prototype;
+    JSObject* obj = this;
+    while (true) {
+        if (obj-&gt;structure(vm)-&gt;hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj-&gt;type() == ProxyObjectType)
+            return false;
+
+        prototype = obj-&gt;prototype();
+        if (prototype.isNull())
+            return true;
+
+        obj = asObject(prototype);
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
</ins><span class="cx"> // ECMA 8.6.2.2
</span><span class="cx"> ALWAYS_INLINE void JSObject::putInline(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="lines">@@ -44,23 +66,14 @@
</span><span class="cx">         putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    
-    // Check if there are any setters or getters in the prototype chain
-    JSValue prototype;
-    if (propertyName != exec-&gt;propertyNames().underscoreProto) {
-        for (JSObject* obj = thisObject; !obj-&gt;structure(vm)-&gt;hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
-            prototype = obj-&gt;prototype();
-            if (prototype.isNull()) {
-                ASSERT(!thisObject-&gt;structure(vm)-&gt;prototypeChainMayInterceptStoreTo(exec-&gt;vm(), propertyName));
-                if (!thisObject-&gt;putDirectInternal&lt;PutModePut&gt;(vm, propertyName, value, 0, slot)
-                    &amp;&amp; slot.isStrictMode())
-                    throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
-                return;
-            }
-        }
-    }
</del><span class="cx"> 
</span><del>-    thisObject-&gt;putInlineSlow(exec, propertyName, value, slot);
</del><ins>+    if (thisObject-&gt;canPerformFastPutInline(exec, vm, propertyName)) {
+        ASSERT(!thisObject-&gt;structure(vm)-&gt;prototypeChainMayInterceptStoreTo(exec-&gt;vm(), propertyName));
+        if (!thisObject-&gt;putDirectInternal&lt;PutModePut&gt;(vm, propertyName, value, 0, slot)
+            &amp;&amp; slot.isStrictMode())
+            throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
+    } else
+        thisObject-&gt;putInlineSlow(exec, propertyName, value, slot);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSType.h (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSType.h        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/JSType.h        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -78,7 +78,9 @@
</span><span class="cx">     GlobalObjectType,
</span><span class="cx">     ClosureObjectType,
</span><span class="cx"> 
</span><del>-    LastJSCObjectType = ClosureObjectType,
</del><ins>+    ProxyObjectType,
+
+    LastJSCObjectType = ProxyObjectType,
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> COMPILE_ASSERT(sizeof(JSType) == sizeof(uint8_t), sizeof_jstype_is_one_byte);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -300,6 +300,88 @@
</span><span class="cx">     return thisObject-&gt;getOwnPropertySlotCommon(exec, ident.impl(), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template &lt;typename PerformDefaultPutFunction&gt;
+void ProxyObject::performPut(ExecState* exec, JSValue putValue, JSValue thisValue, PropertyName propertyName, PerformDefaultPutFunction performDefaultPutFunction)
+{
+    VM&amp; vm = exec-&gt;vm();
+    JSValue handlerValue = this-&gt;handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'handler' is null. It should be an Object.&quot;));
+        return;
+    }
+
+    JSObject* handler = jsCast&lt;JSObject*&gt;(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue setMethod = handler-&gt;getMethod(exec, callData, callType, vm.propertyNames-&gt;set, ASCIILiteral(&quot;'set' property of a Proxy's handler should be callable.&quot;));
+    if (exec-&gt;hadException())
+        return;
+    JSObject* target = this-&gt;target();
+    if (setMethod.isUndefined()) {
+        performDefaultPutFunction();
+        return;
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&amp;vm, propertyName.uid())));
+    arguments.append(putValue);
+    arguments.append(thisValue);
+    JSValue trapResult = call(exec, setMethod, callType, callData, handler, arguments);
+    if (exec-&gt;hadException())
+        return;
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    if (exec-&gt;hadException())
+        return;
+    if (!trapResultAsBool)
+        return;
+
+    PropertyDescriptor descriptor;
+    if (target-&gt;getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), putValue)) {
+                throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'.&quot;));
+                return;
+            }
+        } else if (descriptor.isAccessorDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; descriptor.setter().isUndefined()) {
+            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false.&quot;));
+            return;
+        }
+    }
+}
+
+void ProxyObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
+{
+    VM&amp; vm = exec-&gt;vm();
+    ProxyObject* thisObject = jsCast&lt;ProxyObject*&gt;(cell);
+    auto performDefaultPut = [&amp;] () {
+        JSObject* target = jsCast&lt;JSObject*&gt;(thisObject-&gt;target());
+        target-&gt;methodTable(vm)-&gt;put(target, exec, propertyName, value, slot);
+    };
+    thisObject-&gt;performPut(exec, value, slot.thisValue(), propertyName, performDefaultPut);
+}
+
+void ProxyObject::putByIndexCommon(ExecState* exec, JSValue thisValue, unsigned propertyName, JSValue putValue, bool shouldThrow)
+{
+    VM&amp; vm = exec-&gt;vm();
+    Identifier ident = Identifier::from(exec, propertyName); 
+    if (exec-&gt;hadException())
+        return;
+    auto performDefaultPut = [&amp;] () {
+        JSObject* target = this-&gt;target();
+        bool isStrictMode = shouldThrow;
+        PutPropertySlot slot(thisValue, isStrictMode); // We must preserve the &quot;this&quot; target of the putByIndex.
+        target-&gt;methodTable(vm)-&gt;put(target, exec, ident.impl(), putValue, slot);
+    };
+    performPut(exec, putValue, thisValue, ident.impl(), performDefaultPut);
+}
+
+void ProxyObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    ProxyObject* thisObject = jsCast&lt;ProxyObject*&gt;(cell);
+    thisObject-&gt;putByIndexCommon(exec, thisObject, propertyName, value, shouldThrow);
+}
+
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL performProxyCall(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="lines">@@ -345,16 +427,6 @@
</span><span class="cx">     return CallTypeHost;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void ProxyObject::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
-{
-    ProxyObject* thisObject = jsCast&lt;ProxyObject*&gt;(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
-    Base::visitChildren(thisObject, visitor);
-
-    visitor.append(&amp;thisObject-&gt;m_target);
-    visitor.append(&amp;thisObject-&gt;m_handler);
-}
-
</del><span class="cx"> static EncodedJSValue JSC_HOST_CALL performProxyConstruct(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="lines">@@ -476,4 +548,14 @@
</span><span class="cx">     return thisObject-&gt;performDelete(exec, ident.impl(), defaultDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void ProxyObject::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
+{
+    ProxyObject* thisObject = jsCast&lt;ProxyObject*&gt;(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(&amp;thisObject-&gt;m_target);
+    visitor.append(&amp;thisObject-&gt;m_handler);
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.h (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.h        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.h        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><span class="cx"> 
</span><del>-    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | TypeOfShouldCallGetCallData;
</del><ins>+    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | TypeOfShouldCallGetCallData | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
</ins><span class="cx"> 
</span><span class="cx">     static ProxyObject* create(ExecState* exec, Structure* structure, JSValue target, JSValue handler)
</span><span class="cx">     {
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(ProxyObjectType, StructureFlags), info(), NonArray | MayHaveIndexedAccessors);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_EXPORT_INFO;
</span><span class="lines">@@ -55,6 +55,10 @@
</span><span class="cx">     JSObject* target() { return m_target.get(); }
</span><span class="cx">     JSValue handler() { return m_handler.get(); }
</span><span class="cx"> 
</span><ins>+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);
+    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    void putByIndexCommon(ExecState*, JSValue thisValue, unsigned propertyName, JSValue putValue, bool shouldThrow);
+
</ins><span class="cx"> private:
</span><span class="cx">     ProxyObject(VM&amp;, Structure*);
</span><span class="cx">     void finishCreation(VM&amp;, ExecState*, JSValue target, JSValue handler);
</span><span class="lines">@@ -72,6 +76,8 @@
</span><span class="cx">     bool performHasProperty(ExecState*, PropertyName, PropertySlot&amp;);
</span><span class="cx">     template &lt;typename DefaultDeleteFunction&gt;
</span><span class="cx">     bool performDelete(ExecState*, PropertyName, DefaultDeleteFunction);
</span><ins>+    template &lt;typename PerformDefaultPutFunction&gt;
+    void performPut(ExecState*, JSValue putValue, JSValue thisValue, PropertyName, PerformDefaultPutFunction);
</ins><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;JSObject&gt; m_target;
</span><span class="cx">     WriteBarrier&lt;Unknown&gt; m_handler;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestses6yaml"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/es6.yaml (197135 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/es6.yaml        2016-02-25 22:44:30 UTC (rev 197135)
+++ trunk/Source/JavaScriptCore/tests/es6.yaml        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -963,7 +963,7 @@
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_Array.prototype.toString.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_Array.prototype_iteration_methods.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_ClassDefinitionEvaluation.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_CreateDynamicFunction.js
</span><span class="lines">@@ -1033,27 +1033,27 @@
</span><span class="cx"> - path: es6/Proxy_internal_ownKeys_calls_TestIntegrityLevel.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.from.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.of.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.copyWithin.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.fill.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.pop.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.push.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.reverse.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.shift.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.splice.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_set_calls_Array.prototype.unshift.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_set_calls_Object.assign.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_isExtensible_handler.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_JSON.stringify_support.js
</span><span class="lines">@@ -1065,9 +1065,9 @@
</span><span class="cx"> - path: es6/Proxy_Proxy.revocable.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_set_handler.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_set_handler_instances_of_proxies.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_setPrototypeOf_handler.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Reflect_Reflect.construct.js
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressproxysetjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/proxy-set.js (0 => 197136)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/proxy-set.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/proxy-set.js        2016-02-25 22:58:23 UTC (rev 197136)
</span><span class="lines">@@ -0,0 +1,646 @@
</span><ins>+function assert(b) {
+    if (!b)
+        throw new Error(&quot;Bad assertion&quot;);
+}
+
+{
+    let target = {
+        x: 30
+    };
+
+    let called = false;
+    let handler = {
+        set: 45
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        let threw = false;
+        try {
+            proxy.x = 40;
+        } catch(e) {
+            assert(e.toString() === &quot;TypeError: 'set' property of a Proxy's handler should be callable.&quot;);
+            threw = true;
+        }
+        assert(threw);
+    }
+}
+
+{
+    let target = {
+        x: 30
+    };
+
+    let error = null;
+    let handler = {
+        get set() {
+            error = new Error;
+            throw error;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        let threw = false;
+        try {
+            proxy.x = 40;
+        } catch(e) {
+            assert(e === error);
+            threw = true;
+        }
+        assert(threw);
+        error = null;
+    }
+}
+
+{
+    let target = {
+        x: 30
+    };
+
+    let error = null;
+    let handler = {
+        set: function() {
+            error = new Error;
+            throw error;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        let threw = false;
+        try {
+            proxy.x = 40;
+        } catch(e) {
+            assert(e === error);
+            threw = true;
+        }
+        assert(threw);
+        error = null;
+    }
+}
+
+{
+    let target = { };
+    Object.defineProperty(target, &quot;x&quot;, {
+        configurable: false,
+        writable: false,
+        value: 500
+    });
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === target);
+            called = true;
+            theTarget[propName] = value;
+            return false;    
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = 40;
+        assert(called);
+        assert(proxy.x === 500);
+        assert(target.x === 500);
+        called = false;
+    }
+}
+
+{
+    let target = { };
+    Object.defineProperty(target, &quot;x&quot;, {
+        configurable: false,
+        writable: false,
+        value: 500
+    });
+
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === target);
+            theTarget[propName] = value;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        let threw = false;
+        try {
+            proxy.x = 40;
+        } catch(e) {
+            threw = true;
+            assert(e.toString() === &quot;TypeError: Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'.&quot;);
+        }
+        assert(threw);
+    }
+}
+
+{
+    let target = { };
+    Object.defineProperty(target, &quot;x&quot;, {
+        configurable: false,
+        get: function() {
+            return 25;
+        }
+    });
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === target);
+            called = true;
+            theTarget[propName] = value;
+            return false;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = 40;
+        assert(proxy.x === 25);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let target = { };
+    Object.defineProperty(target, &quot;x&quot;, {
+        configurable: false,
+        get: function() {
+            return 25;
+        }
+    });
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === target);
+            called = true;
+            theTarget[propName] = value;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        let threw = false;
+        try {
+            proxy.x = 40;
+        } catch(e) {
+            threw = true;
+            assert(e.toString() === &quot;TypeError: Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false.&quot;);
+        }
+        assert(threw);
+    }
+}
+
+{
+    let target = { };
+    Object.defineProperty(target, &quot;x&quot;, {
+        configurable: false,
+        writable: true,
+        value: 50
+    });
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === target);
+            called = true;
+            theTarget[propName] = value;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = i;
+        assert(called);
+        assert(proxy.x === i);
+        assert(target.x === i);
+        called = false;
+    }
+}
+
+{
+    let target = {
+        x: 30
+    };
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === proxy);
+            called = true;
+            theTarget[propName] = value;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = i;
+        assert(called);
+        assert(proxy.x === i);
+        assert(target.x === i);
+        called = false;
+
+        proxy[&quot;y&quot;] = i;
+        assert(called);
+        assert(proxy.y === i);
+        assert(target.y === i);
+        called = false;
+    }
+}
+
+{
+    let target = {
+        x: 30
+    };
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === proxy);
+            called = true;
+            theTarget[propName] = value;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = i;
+        assert(called);
+        assert(proxy.x === i);
+        assert(target.x === i);
+        called = false;
+
+        proxy[&quot;y&quot;] = i;
+        assert(called);
+        assert(proxy.y === i);
+        assert(target.y === i);
+        called = false;
+    }
+}
+
+{
+    let target = [];
+
+    let called = false;
+    let handler = { };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy[i] = i;
+        assert(proxy[i] === i);
+        assert(target[i] === i);
+    }
+}
+
+{
+    let target = [];
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === proxy);
+            called = true;
+            theTarget[propName] = value;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy[i] = i;
+        assert(proxy[i] === i);
+        assert(target[i] === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let target = [];
+
+    let called = false;
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === proxy);
+            called = true;
+            theTarget[propName] = value;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy[i] = i;
+        assert(proxy[i] === i);
+        assert(target[i] === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let called = false;
+    let target = {
+        set x(v) {
+            assert(this === target);
+            this._x = v;
+            called = true;
+        },
+        get x() {
+            assert(this === target);
+            return this._x;
+        }
+    };
+
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === proxy);
+            theTarget[propName] = value;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i &lt; 1000; i++) {
+        proxy.x = i;
+        assert(called);
+        assert(proxy.x === i);
+        assert(target.x === i);
+        assert(proxy._x === i);
+        assert(target._x === i);
+        called = false;
+    }
+}
+
+{
+    let called = false;
+    let target = {};
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === obj);
+            theTarget[propName] = value;
+            called = true;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        own: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj.own = i;
+        assert(!called);
+        assert(obj.own === i);
+
+        obj.notOwn = i;
+        assert(target.notOwn === i);
+        assert(proxy.notOwn === i);
+        assert(obj.notOwn === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let target = {};
+    let handler = { };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        own: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj.own = i;
+        assert(obj.own === i);
+        assert(proxy.own === undefined);
+
+        obj.notOwn = i;
+        assert(target.notOwn === i);
+        assert(proxy.notOwn === i);
+        assert(obj.notOwn === i);
+    }
+}
+
+{
+    let called = false;
+    let target = {};
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            assert(reciever === obj);
+            theTarget[propName] = value;
+            called = true;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        [0]: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj[0] = i;
+        assert(!called);
+        assert(obj[0] === i);
+        assert(proxy[0] === undefined);
+
+        obj[1] = i;
+        assert(target[1] === i);
+        assert(proxy[1] === i);
+        assert(obj[1] === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let target = {};
+    let handler = { };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        [0]: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj[0] = i;
+        assert(obj[0] === i);
+        assert(proxy[0] === undefined);
+
+        obj[1] = i;
+        assert(target[1] === i);
+        assert(proxy[1] === i);
+        assert(obj[1] === i);
+    }
+}
+
+{
+    let called = false;
+    let target = {};
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            //assert(reciever === obj);
+            theTarget[propName] = value;
+            called = true;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        [0]: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj[0] = i;
+        assert(!called);
+        assert(obj[0] === i);
+        assert(proxy[0] === undefined);
+
+        obj[1] = i;
+        assert(target[1] === i);
+        assert(proxy[1] === i);
+        assert(obj[1] === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let called = false;
+    let target = [25];
+    let handler = {
+        set: function(theTarget, propName, value, reciever) {
+            assert(target === theTarget);
+            //assert(reciever === obj);
+            theTarget[propName] = value;
+            called = true;
+            return true;
+        }
+    };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        [0]: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj[0] = i;
+        assert(!called);
+        assert(obj[0] === i);
+        assert(proxy[0] === 25);
+
+        obj[1] = i;
+        assert(target[1] === i);
+        assert(proxy[1] === i);
+        assert(obj[1] === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let called = false;
+    let ogTarget = {};
+    let target = new Proxy(ogTarget, {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === ogTarget);
+            assert(reciever === obj);
+            called = true;
+            theTarget[propName] = value;
+        }
+    });
+    let handler = { };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        own: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj.own = i;
+        assert(!called);
+        assert(obj.own === i);
+        assert(proxy.own === undefined);
+
+        obj.notOwn = i;
+        assert(target.notOwn === i);
+        assert(proxy.notOwn === i);
+        assert(obj.notOwn === i);
+        assert(called);
+        called = false;
+    }
+}
+
+{
+    let called = false;
+    let ogTarget = [25];
+    let target = new Proxy(ogTarget, {
+        set: function(theTarget, propName, value, reciever) {
+            assert(theTarget === ogTarget);
+            assert(reciever === obj);
+            called = true;
+            theTarget[propName] = value;
+        }
+    });
+    let handler = { };
+
+    let proxy = new Proxy(target, handler);
+    let obj = Object.create(proxy, {
+        [0]: {
+            writable: true,
+            configurable: true,
+            value: null
+        }
+    });
+    for (let i = 0; i &lt; 1000; i++) {
+        obj[0] = i;
+        assert(!called);
+        assert(obj[0] === i);
+        assert(proxy[0] === 25);
+
+        obj[1] = i;
+        assert(target[1] === i);
+        assert(proxy[1] === i);
+        assert(obj[1] === i);
+        assert(called);
+        called = false;
+    }
+}
</ins></span></pre>
</div>
</div>

</body>
</html>