Issue #1952 - m-c 1440468: Proxied functions can't be passed to Function.prototype.toString.call()

4 files changed, 11 insertions, 15 deletions

diff --git a/js/src/jit-test/tests/basic/bug807623.js b/js/src/jit-test/tests/basic/bug807623.js
index ce16ffd417..35c34d3cb3 100644
--- a/js/src/jit-test/tests/basic/bug807623.js
+++ b/js/src/jit-test/tests/basic/bug807623.js
@@ -3,12 +3,7 @@ var functionProxy = new Proxy(function() {}, {});
 
 assertEq(Object.prototype.toString.call(objectProxy), '[object Object]');
 assertEq(Object.prototype.toString.call(functionProxy), '[object Function]');
-try {
-  Function.prototype.toString.call(functionProxy);
-  assertEq(true, false);
-} catch (e) {
-  assertEq(!!/incompatible/.exec(e), true);
-}
+
 try {
   Function.prototype.toString.call(objectProxy);
   assertEq(true, false);
diff --git a/js/src/jit-test/tests/proxy/function-toString.js b/js/src/jit-test/tests/proxy/function-toString.js
index cedcf552a4..4aca5c907e 100644
--- a/js/src/jit-test/tests/proxy/function-toString.js
+++ b/js/src/jit-test/tests/proxy/function-toString.js
@@ -1,10 +1,10 @@
 load(libdir + 'asserts.js');
 
-// Function.prototype.toString doesn't accept ES6 proxies.
+var nativeCode = "function () {\n    [native code]\n}";
 
 var proxy = new Proxy(function() {}, {});
-assertThrowsInstanceOf(() => Function.prototype.toString.call(proxy), TypeError);
+assertEq(Function.prototype.toString.call(proxy), nativeCode);
 var o = Proxy.revocable(function() {}, {});
-assertThrowsInstanceOf(() => Function.prototype.toString.call(o.proxy), TypeError);
+assertEq(Function.prototype.toString.call(o.proxy), nativeCode);
 o.revoke();
-assertThrowsInstanceOf(() => Function.prototype.toString.call(o.proxy), TypeError);
+assertEq(Function.prototype.toString.call(o.proxy), nativeCode);
diff --git a/js/src/proxy/BaseProxyHandler.cpp b/js/src/proxy/BaseProxyHandler.cpp
index 516ecd79d8..6cd526d059 100644
--- a/js/src/proxy/BaseProxyHandler.cpp
+++ b/js/src/proxy/BaseProxyHandler.cpp
@@ -319,8 +319,9 @@ BaseProxyHandler::fun_toString(JSContext* cx, HandleObject proxy, bool isToSourc
 {
     if (proxy->isCallable())
         return JS_NewStringCopyZ(cx, "function () {\n    [native code]\n}");
-    RootedValue v(cx, ObjectValue(*proxy));
-    ReportIsNotFunction(cx, v);
+
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
+                              js_Function_str, js_toString_str, "object");
     return nullptr;
 }
 
diff --git a/js/src/proxy/ScriptedProxyHandler.cpp b/js/src/proxy/ScriptedProxyHandler.cpp
index 19d4b67850..5a219e2e3f 100644
--- a/js/src/proxy/ScriptedProxyHandler.cpp
+++ b/js/src/proxy/ScriptedProxyHandler.cpp
@@ -1259,9 +1259,9 @@ ScriptedProxyHandler::className(JSContext* cx, HandleObject proxy) const
 JSString*
 ScriptedProxyHandler::fun_toString(JSContext* cx, HandleObject proxy, bool isToSource) const
 {
-    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
-                              js_Function_str, js_toString_str, "object");
-    return nullptr;
+    // The BaseProxyHandler has the desired behavior: Throw for non-callable,
+    // otherwise return [native code].
+    return BaseProxyHandler::fun_toString(cx, proxy, isToSource);
 }
 
 bool