gistfile1.txt

diff --git a/js/src/jit-test/tests/proxy/testDirectProxyArrayLength.js b/js/src/jit-test/tests/proxy/testDirectProxyArrayLength.js
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/proxy/testDirectProxyArrayLength.js
@@ -0,0 +1,4 @@
+var a = [1, 2, 3];
+var p = new Proxy(a, {});
+assertEq(p.length, 3);
+assertEq(JSON.stringify(p), "[1,2,3]");
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -961,17 +961,17 @@ EmitGetterCall(JSContext *cx, MacroAssem
         MOZ_ASSERT(target);
 
         // Push stubCode for marking.
         attacher.pushStubCodePointer(masm);
 
         // JSPropertyOp: bool fn(JSContext *cx, HandleObject obj, HandleId id, MutableHandleValue vp)
 
         // Push args on stack first so we can take pointers to make handles.
-        masm.Push(UndefinedValue());
+        masm.Push(ObjectValue(*holder));
         masm.movePtr(StackPointer, argVpReg);
 
         // push canonical jsid from shape instead of propertyname.
         masm.Push(shape->propid(), scratchReg);
         masm.movePtr(StackPointer, argIdReg);
 
         masm.Push(object);
         masm.movePtr(StackPointer, argObjReg);
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -442,25 +442,18 @@ js::SetLengthProperty(JSContext *cx, Han
  * to be careful about the length getter and setter being called on an object
  * not of Array class. For the getter, we search obj's prototype chain for the
  * array that caused this getter to be invoked. In the setter case to overcome
  * the JSPROP_SHARED attribute, we must define a shadowing length property.
  */
 static bool
 array_length_getter(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValue vp)
 {
-    RootedObject obj(cx, obj_);
-    do {
-        if (obj->is<ArrayObject>()) {
-            vp.setNumber(obj->as<ArrayObject>().length());
-            return true;
-        }
-        if (!GetPrototype(cx, obj, &obj))
-            return false;
-    } while (obj);
+    RootedObject obj(cx, &vp.toObject());
+    vp.setNumber(obj->as<ArrayObject>().length());
     return true;
 }
 
 static bool
 array_length_setter(JSContext *cx, HandleObject obj, HandleId id, bool strict, MutableHandleValue vp)
 {
     if (!obj->is<ArrayObject>()) {
         // This array .length property was found on the prototype
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -1538,26 +1538,28 @@ js::NativeDefineElement(ExclusiveContext
 
     return NativeDefineProperty(cx, obj, id, value, getter, setter, attrs);
 }
 
 
 /*** [[Get]] *************************************************************************************/
 
 static inline bool
-CallGetter(JSContext* cx, HandleObject receiver, HandleShape shape, MutableHandleValue vp)
+CallGetter(JSContext* cx, HandleObject receiver, HandleObject obj, HandleShape shape,
+           MutableHandleValue vp)
 {
     MOZ_ASSERT(!shape->hasDefaultGetter());
 
     if (shape->hasGetterValue()) {
         Value fval = shape->getterValue();
         return InvokeGetterOrSetter(cx, receiver, fval, 0, 0, vp);
     }
 
     RootedId id(cx, shape->propid());
+    vp.setObject(*obj);
     return CallJSPropertyOp(cx, shape->getterOp(), receiver, id, vp);
 }
 
 template <AllowGC allowGC>
 static MOZ_ALWAYS_INLINE bool
 GetExistingProperty(JSContext *cx,
                     typename MaybeRooted<JSObject*, allowGC>::HandleType receiver,
                     typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
@@ -1593,16 +1595,17 @@ GetExistingProperty(JSContext *cx,
         }
     }
 
     if (!allowGC)
         return false;
 
     if (!CallGetter(cx,
                     MaybeRooted<JSObject*, allowGC>::toHandle(receiver),
+                    MaybeRooted<JSObject*, allowGC>::toHandle(obj),
                     MaybeRooted<Shape*, allowGC>::toHandle(shape),
                     MaybeRooted<Value, allowGC>::toMutableHandle(vp)))
     {
         return false;
     }
 
     // Ancient nonstandard extension: via the JSAPI it's possible to create a
     // data property that has both a slot and a getter. In that case, copy the