another case

Author: VSadov

lib/Runtime/Library/JavascriptProxy.cpp

@@ -272,6 +272,8 @@ namespace Js
             {
                 JavascriptError::ThrowTypeError(requestContext, JSERR_InconsistentTrapResult, _u("getOwnPropertyDescriptor"));
             }
+
+            // do not use "target" here, the trap may have caused it to change
             if (!targetObj->IsExtensible())
             {
                 JavascriptError::ThrowTypeError(requestContext, JSERR_InconsistentTrapResult, _u("getOwnPropertyDescriptor"));
@@ -292,7 +294,8 @@ namespace Js
         //i.Throw a TypeError exception.
         //22. Return resultDesc.
 
-        BOOL isTargetExtensible = target->IsExtensible();
+        // do not use "target" here, the trap may have caused it to change
+        BOOL isTargetExtensible = targetObj->IsExtensible();
         BOOL toProperty = JavascriptOperators::ToPropertyDescriptor(getResult, resultDescriptor, requestContext);
         if (!toProperty && isTargetExtensible)
         {

test/es6/proxybugs.js

@@ -253,6 +253,27 @@ var tests = [
             assert.isTrue(trapCalled);
         }
     },
+    {
+        name: "Assertion validation : revoking the proxy in getOwnPropertyDescriptor trap, not undefined return",
+        body() {
+            var trapCalled = false;
+            var handler = {
+                getOwnPropertyDescriptor: function (a, b, c) {
+                    trapCalled = true;
+                    let result = Object.getOwnPropertyDescriptor(obj, 'proxy');
+
+                    obj.revoke();
+
+                    // used to cause AV
+                    return result;
+                }
+            };
+
+            var obj = Proxy.revocable({}, handler);
+            Object.getOwnPropertyDescriptor(obj.proxy);
+            assert.isTrue(trapCalled);
+        }
+    },
     {
         name: "Assertion validation : revoking the proxy by invoking getOwnPropertyDescriptor trap but no handler present",
         body() {