Make integer indexed properties ("elements") work for proxies.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 81c03657c63f6940f8adacd4a5733ccd293daaa6..aa21bdb9f2de8c3ab5a3a89da5bba1ac56b205c8 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4193,6 +4193,14 @@ MaybeObject* Runtime::SetObjectProperty(Isolate* isolate,
     return isolate->Throw(*error);
   }
 
+  if (object->IsJSProxy()) {
+    bool has_pending_exception = false;
+    Handle<Object> name = Execution::ToString(key, &has_pending_exception);
+    if (has_pending_exception) return Failure::Exception();
+    return JSProxy::cast(*object)->SetProperty(
+        String::cast(*name), *value, attr, strict_mode);
+  }
+
   // If the object isn't a JavaScript object, we ignore the store.
   if (!object->IsJSObject()) return *value;
 
@@ -4312,7 +4320,7 @@ MaybeObject* Runtime::ForceDeleteObjectProperty(Isolate* isolate,
 
   // Check if the given key is an array index.
   uint32_t index;
-  if (receiver->IsJSObject() && key->ToArrayIndex(&index)) {
+  if (key->ToArrayIndex(&index)) {
     // In Firefox/SpiderMonkey, Safari and Opera you can access the
     // characters of a string using [] notation.  In the case of a
     // String object we just need to redirect the deletion to the
@@ -4323,8 +4331,7 @@ MaybeObject* Runtime::ForceDeleteObjectProperty(Isolate* isolate,
       return isolate->heap()->true_value();
     }
 
-    return JSObject::cast(*receiver)->DeleteElement(
-        index, JSReceiver::FORCE_DELETION);
+    return receiver->DeleteElement(index, JSReceiver::FORCE_DELETION);
   }
 
   Handle<String> key_string;
@@ -4491,9 +4498,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_HasProperty) {
   if (args[0]->IsJSReceiver()) {
     JSReceiver* receiver = JSReceiver::cast(args[0]);
     CONVERT_CHECKED(String, key, args[1]);
-    bool result = receiver->HasProperty(key);
-    if (isolate->has_pending_exception()) return Failure::Exception();
-    return isolate->heap()->ToBoolean(result);
+    if (receiver->HasProperty(key)) return isolate->heap()->true_value();
   }
   return isolate->heap()->false_value();
 }
@@ -4503,12 +4508,12 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_HasElement) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
 
-  // Only JS objects can have elements.
-  if (args[0]->IsJSObject()) {
-    JSObject* object = JSObject::cast(args[0]);
+  // Only JS receivers can have elements.
+  if (args[0]->IsJSReceiver()) {

[Rico, 2011/09/12 11:21:18]

Do we ever get here with something other than a JSReceiver?
If not just do a CONVERT_CHECKED(JSReceiver, ...)

[rossberg, 2011/09/13 16:10:25]

Good question. It seems like not, so I changed it.

+    JSReceiver* receiver = JSReceiver::cast(args[0]);
     CONVERT_CHECKED(Smi, index_obj, args[1]);
     uint32_t index = index_obj->value();
-    if (object->HasElement(index)) return isolate->heap()->true_value();
+    if (receiver->HasElement(index)) return isolate->heap()->true_value();
   }
   return isolate->heap()->false_value();
 }