[Webkit-unassigned] [Bug 203560] New: [[HasProperty]] result of Proxy in prototype chain is ignored

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=203560

            Bug ID: 203560
           Summary: [[HasProperty]] result of Proxy in prototype chain is
                    ignored
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Minor
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: shvaikalesh at gmail.com

When [[HasProperty]] is called on ordinary object with Proxy in prototype chain that implements "has" trap,
falsy result of the trap is ignored and prototype chain gets inspected further.

Test case:
  "prop" in Object.create(
    new Proxy(
      Object.create({ prop: 42 }),
      { has: () => false }
    )
  )

Expected:
  false

Actual:
  true

ECMA262:
https://tc39.es/ecma262/#sec-ordinaryhasproperty (step 5.a)

Test262:
https://test262.report/browse/built-ins/Proxy/has/call-in-prototype.js (non-index)
https://test262.report/browse/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js (index)
https://test262.report/browse/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js (index)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191029/33aa131d/attachment.htm>