From 6c1167b1e2ec6939f88878aa21eebaab7dbe547e Mon Sep 17 00:00:00 2001
From: Anthony Ramine <n.oxyde@gmail.com>
Date: Wed, 24 Aug 2016 15:34:35 +0200
Subject: [PATCH] Pass the receiver to get_property_on_prototype (fixes #11600)

---
 components/script/dom/bindings/codegen/CodegenRust.py       | 2 +-
 components/script/dom/bindings/utils.rs                     | 6 +++---
 .../HTMLCollection-as-proto-length-get-throws.html.ini      | 5 -----
 3 files changed, 4 insertions(+), 9 deletions(-)
 delete mode 100644 tests/wpt/metadata/dom/collections/HTMLCollection-as-proto-length-get-throws.html.ini

diff --git a/components/script/dom/bindings/codegen/CodegenRust.py b/components/script/dom/bindings/codegen/CodegenRust.py
index 4eb02f796e0..643262c0db2 100644
--- a/components/script/dom/bindings/codegen/CodegenRust.py
+++ b/components/script/dom/bindings/codegen/CodegenRust.py
@@ -5050,7 +5050,7 @@ if !expando.is_null() {
 
 %s
 let mut found = false;
-if !get_property_on_prototype(cx, proxy, id, &mut found, vp) {
+if !get_property_on_prototype(cx, proxy, receiver, id, &mut found, vp) {
     return false;
 }
 
diff --git a/components/script/dom/bindings/utils.rs b/components/script/dom/bindings/utils.rs
index 666dba519a4..030584c2755 100644
--- a/components/script/dom/bindings/utils.rs
+++ b/components/script/dom/bindings/utils.rs
@@ -29,7 +29,7 @@ use js::jsapi::{JS_GetProperty, JS_GetPrototype, JS_GetReservedSlot, JS_HasPrope
 use js::jsapi::{JS_HasPropertyById, JS_IsExceptionPending, JS_IsGlobalObject};
 use js::jsapi::{JS_ResolveStandardClass, JS_SetProperty, ToWindowProxyIfWindow};
 use js::jsapi::{JS_StringHasLatin1Chars, MutableHandleValue, ObjectOpResult};
-use js::jsval::{JSVal, ObjectValue, UndefinedValue};
+use js::jsval::{JSVal, UndefinedValue};
 use js::rust::{GCMethods, ToString};
 use libc;
 use std::ffi::CString;
@@ -129,6 +129,7 @@ pub type ProtoOrIfaceArray = [*mut JSObject; PROTO_OR_IFACE_LENGTH];
 /// Returns false on JSAPI failure.
 pub unsafe fn get_property_on_prototype(cx: *mut JSContext,
                                         proxy: HandleObject,
+                                        receiver: HandleValue,
                                         id: HandleId,
                                         found: *mut bool,
                                         vp: MutableHandleValue)
@@ -148,8 +149,7 @@ pub unsafe fn get_property_on_prototype(cx: *mut JSContext,
         return true;
     }
 
-    rooted!(in(cx) let receiver = ObjectValue(&*proxy.get()));
-    JS_ForwardGetPropertyTo(cx, proto.handle(), id, receiver.handle(), vp)
+    JS_ForwardGetPropertyTo(cx, proto.handle(), id, receiver, vp)
 }
 
 /// Get an array index from the given `jsid`. Returns `None` if the given
diff --git a/tests/wpt/metadata/dom/collections/HTMLCollection-as-proto-length-get-throws.html.ini b/tests/wpt/metadata/dom/collections/HTMLCollection-as-proto-length-get-throws.html.ini
deleted file mode 100644
index 0e56cb9f2f3..00000000000
--- a/tests/wpt/metadata/dom/collections/HTMLCollection-as-proto-length-get-throws.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[HTMLCollection-as-proto-length-get-throws.html]
-  type: testharness
-  [HTMLcollection as a prototype should not allow getting .length on the base object]
-    expected: FAIL
-