Bug 1090537, part 1 - Remove an old hack where Proxy::hasOwn permitted SET access. r=bholley.

The comments being deleted here are incorrect; Proxy::set no longer calls handler->hasOwn().

--HG--
extra : rebase_source : 328433d668e99e99373d77bb1956291fb788fac9
Bug 1090537, part 2a - In BaseProxyHandler::set(), do not assume that proxy == receiver or that both have the same handler. r=efaust.

(This was reviewed as "part 3" but it was necessary to switch parts 2 and 3 and add part 2b.)

--HG--
extra : rebase_source : 7ae9ba80620475ff3e001e7b1e041c98194152a6
extra : source : dd32aa64b825cff02ce72df7533cbcc57f782f8f
Bug 1090537, part 2b - In Proxy::set, do not assume that proxy == receiver or that both have the same handler. r=efaust, r=bholley.

--HG--
extra : rebase_source : 0aa0e3e37a2a95f3cfa0399e4380de73a95ab48a
Bug 1090537, part 3 - Pass receiver argument through from JSObject::setGeneric and setElement to Proxy::set. r=efaust.

ES6 specifies [[Set]] as an operation taking both a "this" object and a "receiver" parameter. Both JSObject::setGeneric and Proxy::set support the receiver parameter, but ObjectOps::setGeneric does not; in this patch, we add a little workaround for that. The test shows how this is observable using only standard builtins.

The changes in JSObject::setElement are untestable since currently all call sites pass the same value for obj as for receiver.

(This was reviewed as "part 2" but it was necessary to switch parts 2 and 3 and add part 2b.)

--HG--
extra : rebase_source : 617decfa9be34b01a0f923a9717ad2544d913af9
Bug 1090537, part 4 - Take NativeSet private. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 1c802d28c3f828412624cdcc689fa4a76ee3e59c
Bug 1090537, part 5 - Remove legacy special case in baseops::SetPropertyHelper that cloned the getter and setter of JSPROP_SHADOWABLE properties when shadowed on another native object. r=Waldo.

--HG--
extra : rebase_source : c1478c335a9f5a1484b87ce9c566f1f8c4d9f20d
Bug 1090537, part 6 - Factor out a big chunk of SetPropertyHelper into a separate function template, SetPropertyByDefining. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 5bd292385b3d2a04f28311305a1cb99b27494193
Bug 1090537, part 7 - Eliminate useless attrs argument to SetPropertyByDefining. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 4eb90cb86d576f9014265b9b00808a099f589915
Bug 1090537, part 8 - In SetPropertyHelper, if defining a new data property, define it on receiver, not obj. r=efaust.

Most of the diff is just renaming an argument. The only new code is necessary because unlike obj, receiver can be non-native.

--HG--
extra : rebase_source : 115769a212724dddec315663a7a7e71a9abaa992
Bug 1090537, part 9 - Just move SetPropertyByDefining. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 8accf39f3c7e3d9d4121244213173aa5581f57d3
 Bug 1090537, part 10 - Factor out SetNonexistentProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : f9bbad80dcb455bfccb5ad9cead6dcb7b53d71d3
Bug 1090537, part 11 - Delete a special case for arrays in SetNonexistentProperty that is (a) unreachable; (b) redundant with a check in DefinePropertyOrElement. r=efaust.

The code being deleted would be ineffective even if we did have Reflect.set, but Reflect.set does enable a very near miss (where receiver, not obj, is an array), so we leave a sleeper test for that case.

--HG--
extra : rebase_source : ea38558aaa9e52ebb999cf1eea53abfde5608161
Bug 1090537, part 12 - Change SetNonexistentProperty to use only receiver, not obj. No change in behavior. r=efaust.

(The behavior doesn't change because Unqualified is only passed from two call sites, and in both places, the same object is passed for both receiver and obj.)

--HG--
extra : rebase_source : 9e71c3aca2d35829c9be8386e4855ad050e12a13
extra : amend_source : 3f95d45b5d630f4a2d45869c84520b28dc936792