[Webkit-unassigned] [Bug 203560] [[HasProperty]] result of Proxy in prototype chain is ignored

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=203560

--- Comment #18 from Alexey Shvayka <shvaikalesh at gmail.com> ---
(In reply to Saam Barati from comment #17)
> Comment on attachment 383041 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=383041&action=review
> 
> > Source/JavaScriptCore/runtime/JSObjectInlines.h:129
> > +        if (object->type() == ProxyObjectType && slot.internalMethodType() == PropertySlot::InternalMethodType::HasProperty)
> 
> What about when it’s not in the prototype chain though? What if the proxy is
> the base?

This case is handled by `JSObject* object = this;` on lines 121 and 152 (before loops), isn't it?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191202/47aca083/attachment.htm>