Bug 1090636, part 1 - Factor out SetExistingProperty from SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 99fe3ebcf098cebd51d38c687349fe6aa3a43a59
Bug 1090636, part 2 - Move SetExistingProperty above SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 3e8a5f35bbdda14233bb6df1e919abeb4a0f0624
Bug 1090636, part 3 - Shadow an existing property even if pobj == obj. r=efaust.

--HG--
extra : rebase_source : 2b41d716df229233ff5bcaff8c7fcdf3926f3ab9
Bug 1090636, part 4 - Update SetPropertyByDefining to implement ES6 draft rev 28 section 9.1.9 steps 5.c-f. r=efaust.

--HG--
extra : rebase_source : 558852c474d603299c47b630bd73b1ae951c6928
Bug 1090636, part 5 - In SetExistingProperty, correctly handle assigning to array.length. r=efaust.

This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)

Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.

This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.

--HG--
extra : rebase_source : 18704b24f65bd3336d5c2b2f3e7366b01e7fcec0
Bug 1090636, part 6 - Change DefineNativeProperty to support redefining array elements. r=efaust.

As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.

--HG--
extra : rebase_source : 1e2741d096f5ac72ae8305aa548747242b44ace7
Bug 1090636, part 7 - Assigning to an array element via a proxy should trigger the "shadowing" code. r=efaust.

--HG--
extra : rebase_source : b1ae5853de1dc4d100c5f9b7d45e1d2272b512f7
Bug 1090636, part 8 - Factor out SetDenseOrTypedArrayElement from SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : a81ae31c30c8d0206b7e18f79afeb1c6eee8b201
Bug 1090636, part 9 - Move SetDenseOrTypedArrayElement above SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : cc4b742f509392984a82d48d022252291f4182fd
Bug 1090636, part 10 - Refactor SetExistingProperty. No change in behavior. r=efaust.

At this point, SetPropertyHelper has been factored into five parts:
  SetPropertyByDefining
  SetNonexistentProperty
  SetDenseOrTypedArrayElement
  SetExistingProperty
  SetPropertyHelper

each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.

--HG--
extra : rebase_source : 590d09b7da81417f44580b06b5d5b4e634b641fa
Bug 1090636, part 11 - Pass pobj (the object that contains the element) to SetDenseOrTypedArrayElement rather than obj. Reflect.set could trigger the bug being fixed here, so we leave a sleeper test for it. r=efaust.

--HG--
extra : rebase_source : 18e873daea8da331e5c8861e537ed2ba17944b06
Bug 1090636, part 12 - Move NativeSet. No change in behavior. r=efaust.

--HG--
extra : rebase_source : b4adc226db90d3a5fbd16d4b63ea4bc00d02697c
Bug 1090636, part 13 - Reimplement the mHasPrototype part of Proxy::set as a call to BaseProxyHandler::set. r=bholley.

--HG--
extra : rebase_source : edc9dd5f8a45e5112af13073b41e6f6879c6f2ce
Bug 1090636, part 14 - Rewrite SetPropertyHelper. r=efaust.

With this patch:

*   SetPropertyHelper no longer calls lookupProperty hooks, which is nice
    since there's no such thing in ES6.

*   As SetPropertyHelper walks the prototype chain, as soon as it reaches a
    non-native object, it calls that object's set hook, passing the original
    receiver, and returns.

    This means Proxy set traps will now be called per spec when triggered via
    the prototype chain from a native object.

    It also means that legacy scripted indirect proxies (Proxy.create) will
    now sometimes have their set trap called when it wouldn't have been called
    before. This seems to be confined to fuzztests in practice, since it only
    matters when the proxy is used as the prototype of an ordinary object.
    But it could cause trouble.

    The same situation affects other proxies too: BaseProxyHandler::set() and
    its overrides will all be called in new situations. It's inevitable though;
    Reflect.set was going to enable all these situations anyway.

--HG--
extra : rebase_source : afd950d3593f5c6dc2c24c8aec92567d9c1269d2
Bug 1090636, part 15 - Optimize away the HasOwnProperty call in SetPropertyByDefining, in the common case. No change in behavior, theoretically. r=efaust.

--HG--
extra : rebase_source : 6c8840025cabcd9041bfe4c05c50925c28229f4f