Bug 1090636, part 1 - Factor out SetExistingProperty from SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 375efc7d9b4b07544f48b53ca5d9031ea4dda2c1
extra : source : 388e4a23e7fb0be8a7f7561e7043531c7132e6f0
Bug 1090636, part 2 - Move SetExistingProperty above SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 69f6d18d98d066adfb2742dd5f4411a2a5b3b7a5
extra : source : db5a8d2f9a23ec92e03d9ec5c5ed609179c32abe
Bug 1090636, part 3 - Shadow an existing property even if pobj == obj. r=efaust.

--HG--
extra : rebase_source : 798fff4a674af97ced2f8972ac65bb5761ac4f27
extra : source : 6425c066275186a8b072e7fa2235af6a9b1b202e
Bug 1090636, part 4 - Update SetPropertyByDefining to implement ES6 draft rev 28 section 9.1.9 steps 5.c-f. r=efaust.

--HG--
extra : rebase_source : c0444b48a571a4c58dc2aef64d8c2fbb6ddc93b5
extra : source : b5a38a0df65d6f7ffeb60344df6155f2aae19bcb
Bug 1090636, part 5 - In SetExistingProperty, correctly handle assigning to array.length. r=efaust.

This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)

Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.

This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.

--HG--
extra : rebase_source : c968a95baf41944ca82a16d40af51a1512ad0938
extra : source : f322eac33cfa1b54486d1d73f62658019774e373
Bug 1090636, part 6 - Change DefineNativeProperty to support redefining array elements. r=efaust.

As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.

--HG--
extra : rebase_source : f939b92b42f0470fb0309097fb82f46383a61b25
extra : source : 1ecbc62d82a38e6e36e6ede090d711f3b3ad13ba
Bug 1090636, part 7 - Assigning to an array element via a proxy should trigger the "shadowing" code. r=efaust.

--HG--
extra : rebase_source : 8cdde27dfe42ef2ade0220b7930de66d0249db92
Bug 1090636, part 8 - Factor out SetDenseOrTypedArrayElement from SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : ca88c753431c65130ea9bad71fd36a8c88a747d4
Bug 1090636, part 9 - Move SetDenseOrTypedArrayElement above SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : ef3261205f73b1984a798d68b661aee662ad5a66
Bug 1090636, part 10 - Refactor SetExistingProperty. No change in behavior. r=efaust.

At this point, SetPropertyHelper has been factored into five parts:
  SetPropertyByDefining
  SetNonexistentProperty
  SetDenseOrTypedArrayElement
  SetExistingProperty
  SetPropertyHelper

each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.

--HG--
extra : rebase_source : 4d32ae23b5cdbaa357c205766894dfaa2184c755
Bug 1090636, part 11 - Pass pobj (the object that contains the element) to SetDenseOrTypedArrayElement rather than obj. Reflect.set could trigger the bug being fixed here, so we leave a sleeper test for it. r=efaust.

--HG--
extra : rebase_source : 712fb4a4ffd98c0c3e6ba10b3c7dd7bfe8d497f5
Bug 1090636, part 12 - Move NativeSet. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 0b78614bc37c7d90132c8e3bb4bb3cafcfde079b
Bug 1090636, part 13 - Reimplement the mHasPrototype part of Proxy::set as a call to BaseProxyHandler::set. r=bholley.

--HG--
extra : rebase_source : 2813538fe67f8ba94b36f7dd24d3ff897e9b84bf
Bug 1090636, part 14 - Rewrite SetPropertyHelper. r=efaust.

With this patch:

*   SetPropertyHelper no longer calls lookupProperty hooks, which is nice
    since there's no such thing in ES6.

*   As SetPropertyHelper walks the prototype chain, as soon as it reaches a
    non-native object, it calls that object's set hook, passing the original
    receiver, and returns.

    This means Proxy set traps will now be called per spec when triggered via
    the prototype chain from a native object.

    It also means that legacy scripted indirect proxies (Proxy.create) will
    now sometimes have their set trap called when it wouldn't have been called
    before. This seems to be confined to fuzztests in practice, since it only
    matters when the proxy is used as the prototype of an ordinary object.
    But it could cause trouble.

    The same situation affects other proxies too: BaseProxyHandler::set() and
    its overrides will all be called in new situations. It's inevitable though;
    Reflect.set was going to enable all these situations anyway.

--HG--
extra : rebase_source : 01bb32b4950ea14922f135bf785aea7d298c8dfb
Bug 1090636, part 15 - Optimize away the HasOwnProperty call in SetPropertyByDefining, in the common case. No change in behavior, theoretically. r=efaust.

--HG--
extra : rebase_source : 98930753e4c19c0db6db8912178d27b0fa5fea2e