Tests for evil side-effects during 'internal methods'.

test/mjsunit/harmony/proxies.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 15 matching lines @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --harmony-proxies
 
 
 // TODO(rossberg): for-in not implemented on proxies.
 
 
 // Helper.
 
-function TestWithProxies(test, handler) {
-  test(handler, Proxy.create)
-  test(handler, function(h) {return Proxy.createFunction(h, function() {})})
+function TestWithProxies(test, x, y, z) {
+  test(Proxy.create, x, y, z)
+  test(function(h) {return Proxy.createFunction(h, function() {})}, x, y, z)
 }
 
 
 
 // Getting property descriptors (Object.getOwnPropertyDescriptor).
 
 var key
 
 function TestGetOwnProperty(handler) {
   TestWithProxies(TestGetOwnProperty2, handler)
 }
 
-function TestGetOwnProperty2(handler, create) {
+function TestGetOwnProperty2(create, handler) {
   var p = create(handler)
   assertEquals(42, Object.getOwnPropertyDescriptor(p, "a").value)
   assertEquals("a", key)
   assertEquals(42, Object.getOwnPropertyDescriptor(p, 99).value)
   assertEquals("99", key)
 }
 
 TestGetOwnProperty({
   getOwnPropertyDescriptor: function(k) {
     key = k
@@ skipping 22 matching lines @@
   get: function(pr, pk) {
     return function(k) { key = k; return {value: 42, configurable: true} }
   }
 }))
 
 
 function TestGetOwnPropertyThrow(handler) {
   TestWithProxies(TestGetOwnPropertyThrow2, handler)
 }
 
-function TestGetOwnPropertyThrow2(handler, create) {
+function TestGetOwnPropertyThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.getOwnPropertyDescriptor(p, "a") }, "myexn")
   assertThrows(function(){ Object.getOwnPropertyDescriptor(p, 77) }, "myexn")
 }
 
 TestGetOwnPropertyThrow({
   getOwnPropertyDescriptor: function(k) { throw "myexn" }
 })
 
 TestGetOwnPropertyThrow({
@@ skipping 18 matching lines @@
 
 
 // Getters (dot, brackets).
 
 var key
 
 function TestGet(handler) {
   TestWithProxies(TestGet2, handler)
 }
 
-function TestGet2(handler, create) {
+function TestGet2(create, handler) {
   var p = create(handler)
   assertEquals(42, p.a)
   assertEquals("a", key)
   assertEquals(42, p["b"])
   assertEquals("b", key)
   assertEquals(42, p[99])
   assertEquals("99", key)
 
   var o = Object.create(p, {x: {value: 88}})
   assertEquals(42, o.a)
@@ skipping 40 matching lines @@
   get: function(pr, pk) {
     return function(r, k) { key = k; return 42 }
   }
 }))
 
 
 function TestGetCall(handler) {
   TestWithProxies(TestGetCall2, handler)
 }
 
-function TestGetCall2(handler, create) {
+function TestGetCall2(create, handler) {
   var p = create(handler)
   assertEquals(55, p.f())
   assertEquals(55, p["f"]())
   assertEquals(55, p.f("unused", "arguments"))
   assertEquals(55, p.f.call(p))
   assertEquals(55, p["f"].call(p))
   assertEquals(55, p[101].call(p))
   assertEquals(55, p.withargs(45, 5))
   assertEquals(55, p.withargs.call(p, 11, 22))
   assertEquals("6655", "66" + p)  // calls p.toString
@@ skipping 65 matching lines @@
   get: function(pr, pk) {
     return function(r, k) { return function() { return 55 } }
   }
 }))
 
 
 function TestGetThrow(handler) {
   TestWithProxies(TestGetThrow2, handler)
 }
 
-function TestGetThrow2(handler, create) {
+function TestGetThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ p.a }, "myexn")
   assertThrows(function(){ p["b"] }, "myexn")
   assertThrows(function(){ p[3] }, "myexn")
 
   var o = Object.create(p, {x: {value: 88}, '4': {value: 89}})
   assertThrows(function(){ o.a }, "myexn")
   assertThrows(function(){ o["b"] }, "myexn")
   assertThrows(function(){ o[3] }, "myexn")
   assertEquals(88, o.x)
@@ skipping 40 matching lines @@
   }
 }))
 
 
 
 // Setters.
 
 var key
 var val
 
-function TestSet(handler, create) {
+function TestSet(handler) {
   TestWithProxies(TestSet2, handler)
 }
 
-function TestSet2(handler, create) {
+function TestSet2(create, handler) {
   var p = create(handler)
   assertEquals(42, p.a = 42)
   assertEquals("a", key)
   assertEquals(42, val)
   assertEquals(43, p["b"] = 43)
   assertEquals("b", key)
   assertEquals(43, val)
   assertEquals(44, p[77] = 44)
   assertEquals("77", key)
   assertEquals(44, val)
@@ skipping 62 matching lines @@
   defineProperty: function(k, desc) { key = k, val = desc.value }
 })
 
 TestSet(Proxy.create({
   get: function(pr, pk) {
     return function(r, k, v) { key = k; val = v; return true }
   }
 }))
 
 
-function TestSetThrow(handler, create) {
+function TestSetThrow(handler) {
   TestWithProxies(TestSetThrow2, handler)
 }
 
-function TestSetThrow2(handler, create) {
+function TestSetThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ p.a = 42 }, "myexn")
   assertThrows(function(){ p["b"] = 42 }, "myexn")
   assertThrows(function(){ p[22] = 42 }, "myexn")
 }
 
 TestSetThrow({
   set: function(r, k, v) { throw "myexn" }
 })
 
@@ skipping 98 matching lines @@
 TestSetThrow(Proxy.create({
   get: function(pr, pk) {
     return function(r, k, v) { throw "myexn" }
   }
 }))
 
 
 var key
 var val
 
-function TestSetForDerived(handler, create) {
+function TestSetForDerived(handler) {
   TestWithProxies(TestSetForDerived2, handler)
 }
 
-function TestSetForDerived2(handler, create) {
+function TestSetForDerived2(create, handler) {
   var p = create(handler)
   var o = Object.create(p, {x: {value: 88, writable: true},
                             '1': {value: 89, writable: true}})
 
   key = ""
   assertEquals(48, o.x = 48)
   assertEquals("", key)  // trap not invoked
   assertEquals(48, o.x)
 
   assertEquals(47, o[1] = 47)
@@ skipping 52 matching lines @@
       case "p_nosetter": return {get: function() { return 1 }, configurable: true}
       case "p_nonconf":return {}
       case "p_throw": throw "myexn"
       case "p_setterthrow": return {set: function(x) { throw "myexn" }}
       default: return undefined
     }
   }
 })
 
 
+// Evil proxy-induced side-effects shouldn't crash.
+// TODO(rossberg): proper behaviour isn't really spec'ed yet, so ignore results.
+
+TestWithProxies(function(create) {
+  var calls = 0
+  var handler = {
+    getPropertyDescriptor: function() {
+      ++calls
+      return (calls % 2 == 1)
+        ? {get: function() { return 5 }, configurable: true}
+        : {set: function() { return false }, configurable: true}
+    }
+  }
+  var p = create(handler)
+  var o = Object.create(p)
+  // Make proxy prototype property read-only after CanPut check.
+  try { o.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestWithProxies(function(create) {
+  var handler = {
+    getPropertyDescriptor: function() {
+      Object.defineProperty(o, "x", {get: function() { return 5 }});
+      return {set: function() {}}
+    }
+  }
+  var p = create(handler)
+  var o = Object.create(p)
+  // Make object property read-only after CanPut check.
+  try { o.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+
+
 // TODO(rossberg): TestSetReject, returning false
 // TODO(rossberg): TestGetProperty, TestSetProperty
 
 
 
 // Property definition (Object.defineProperty and Object.defineProperties).
 
 var key
 var desc
 
 function TestDefine(handler) {
   TestWithProxies(TestDefine2, handler)
 }
 
-function TestDefine2(handler, create) {
+function TestDefine2(create, handler) {
   var p = create(handler)
   assertEquals(p, Object.defineProperty(p, "a", {value: 44}))
   assertEquals("a", key)
   assertEquals(1, Object.getOwnPropertyNames(desc).length)
   assertEquals(44, desc.value)
 
   assertEquals(p, Object.defineProperty(p, "b", {value: 45, writable: false}))
   assertEquals("b", key)
   assertEquals(2, Object.getOwnPropertyNames(desc).length)
   assertEquals(45, desc.value)
@@ skipping 75 matching lines @@
   get: function(pr, pk) {
     return function(k, d) { key = k; desc = d; return true }
   }
 }))
 
 
 function TestDefineThrow(handler) {
   TestWithProxies(TestDefineThrow2, handler)
 }
 
-function TestDefineThrow2(handler, create) {
+function TestDefineThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.defineProperty(p, "a", {value: 44})}, "myexn")
   assertThrows(function(){ Object.defineProperty(p, 0, {value: 44})}, "myexn")
 
 // TODO(rossberg): These tests require for-in on proxies.
 //  var d1 = create({
 //    get: function(r, k) { throw "myexn" },
 //    getOwnPropertyNames: function() { return ["value"] }
 //  })
 //  assertThrows(function(){ Object.defineProperty(p, "p", d1) }, "myexn")
@@ skipping 29 matching lines @@
 
 
 // Property deletion (delete).
 
 var key
 
 function TestDelete(handler) {
   TestWithProxies(TestDelete2, handler)
 }
 
-function TestDelete2(handler, create) {
+function TestDelete2(create, handler) {
   var p = create(handler)
   assertEquals(true, delete p.a)
   assertEquals("a", key)
   assertEquals(true, delete p["b"])
   assertEquals("b", key)
   assertEquals(true, delete p[1])
   assertEquals("1", key)
 
   assertEquals(false, delete p.z1)
   assertEquals("z1", key)
@@ skipping 29 matching lines @@
   get: function(pr, pk) {
     return function(k) { key = k; return k < "z" }
   }
 }))
 
 
 function TestDeleteThrow(handler) {
   TestWithProxies(TestDeleteThrow2, handler)
 }
 
-function TestDeleteThrow2(handler, create) {
+function TestDeleteThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ delete p.a }, "myexn")
   assertThrows(function(){ delete p["b"] }, "myexn");
   assertThrows(function(){ delete p[3] }, "myexn");
 
   (function() {
     "use strict"
     assertThrows(function(){ delete p.c }, "myexn")
     assertThrows(function(){ delete p["d"] }, "myexn")
     assertThrows(function(){ delete p[4] }, "myexn");
@@ skipping 20 matching lines @@
 }))
 
 
 
 // Property descriptors (Object.getOwnPropertyDescriptor).
 
 function TestDescriptor(handler) {
   TestWithProxies(TestDescriptor2, handler)
 }
 
-function TestDescriptor2(handler, create) {
+function TestDescriptor2(create, handler) {
   var p = create(handler)
   var descs = [
     {configurable: true},
     {value: 34, enumerable: true, configurable: true},
     {value: 3, writable: false, mine: "eyes", configurable: true},
     {get value() { return 20 }, get configurable() { return true }},
     {get: function() { "get" }, set: function() { "set" }, configurable: true}
   ]
   for (var i = 0; i < descs.length; ++i) {
     assertEquals(p, Object.defineProperty(p, i, descs[i]))
@@ skipping 18 matching lines @@
     return this.getOwnPropertyDescriptor2(k)
   },
   getOwnPropertyDescriptor2: function(k) { return this["__" + k] }
 })
 
 
 function TestDescriptorThrow(handler) {
   TestWithProxies(TestDescriptorThrow2, handler)
 }
 
-function TestDescriptorThrow2(handler, create) {
+function TestDescriptorThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.getOwnPropertyDescriptor(p, "a") }, "myexn")
 }
 
 TestDescriptorThrow({
   getOwnPropertyDescriptor: function(k) { throw "myexn" }
 })
 
 TestDescriptorThrow({
   getOwnPropertyDescriptor: function(k) {
     return this.getOwnPropertyDescriptor2(k)
   },
   getOwnPropertyDescriptor2: function(k) { throw "myexn" }
 })
 
 
 
 // Comparison.
 
 function TestComparison(eq) {
   TestWithProxies(TestComparison2, eq)
 }
 
-function TestComparison2(eq, create) {
+function TestComparison2(create, eq) {
   var p1 = create({})
   var p2 = create({})
 
   assertTrue(eq(p1, p1))
   assertTrue(eq(p2, p2))
   assertTrue(!eq(p1, p2))
   assertTrue(!eq(p1, {}))
   assertTrue(!eq({}, p2))
   assertTrue(!eq({}, {}))
 }
@@ skipping 22 matching lines @@
 
 
 // Membership test (in).
 
 var key
 
 function TestIn(handler) {
   TestWithProxies(TestIn2, handler)
 }
 
-function TestIn2(handler, create) {
+function TestIn2(create, handler) {
   var p = create(handler)
   assertTrue("a" in p)
   assertEquals("a", key)
   assertTrue(99 in p)
   assertEquals("99", key)
   assertFalse("z" in p)
   assertEquals("z", key)
 
   assertEquals(2, ("a" in p) ? 2 : 0)
   assertEquals(0, !("a" in p) ? 2 : 0)
@@ skipping 63 matching lines @@
   get: function(pr, pk) {
     return function(k) { key = k; return k < "z" }
   }
 }))
 
 
 function TestInThrow(handler) {
   TestWithProxies(TestInThrow2, handler)
 }
 
-function TestInThrow2(handler, create) {
+function TestInThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ return "a" in o }, "myexn")
   assertThrows(function(){ return 99 in o }, "myexn")
   assertThrows(function(){ return !("a" in o) }, "myexn")
   assertThrows(function(){ return ("a" in o) ? 2 : 3 }, "myexn")
   assertThrows(function(){ if ("b" in o) {} }, "myexn")
   assertThrows(function(){ if (!("b" in o)) {} }, "myexn")
   assertThrows(function(){ if ("zzz" in o) {} }, "myexn")
 }
 
@@ skipping 28 matching lines @@
   get: function(pr, pk) {
     return function(k) { throw "myexn" }
   }
 }))
 
 
 function TestInForDerived(handler) {
   TestWithProxies(TestInForDerived2, handler)
 }
 
-function TestInForDerived2(handler, create) {
+function TestInForDerived2(create, handler) {
   var p = create(handler)
   var o = Object.create(p)
 
   assertTrue("a" in o)
   assertEquals("a", key)
   assertTrue(99 in o)
   assertEquals("99", key)
   assertFalse("z" in o)
   assertEquals("z", key)
 
@@ skipping 136 matching lines @@
 
 
 // Own Properties (Object.prototype.hasOwnProperty).
 
 var key
 
 function TestHasOwn(handler) {
   TestWithProxies(TestHasOwn2, handler)
 }
 
-function TestHasOwn2(handler, create) {
+function TestHasOwn2(create, handler) {
   var p = create(handler)
   assertTrue(Object.prototype.hasOwnProperty.call(p, "a"))
   assertEquals("a", key)
   assertTrue(Object.prototype.hasOwnProperty.call(p, 99))
   assertEquals("99", key)
   assertFalse(Object.prototype.hasOwnProperty.call(p, "z"))
   assertEquals("z", key)
 }
 
 TestHasOwn({
@@ skipping 37 matching lines @@
   get: function(pr, pk) {
     return function(k) { key = k; return k < "z" }
   }
 }))
 
 
 function TestHasOwnThrow(handler) {
   TestWithProxies(TestHasOwnThrow2, handler)
 }
 
-function TestHasOwnThrow2(handler, create) {
+function TestHasOwnThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.prototype.hasOwnProperty.call(p, "a")},
     "myexn")
   assertThrows(function(){ Object.prototype.hasOwnProperty.call(p, 99)},
     "myexn")
 }
 
 TestHasOwnThrow({
   hasOwn: function(k) { throw "myexn" }
 })
@@ skipping 144 matching lines @@
   assertTrue(Object.prototype.isPrototypeOf.call(Function.prototype, f))
 }
 
 TestPrototype()
 
 
 
 // Property names (Object.getOwnPropertyNames, Object.keys).
 
 function TestPropertyNames(names, handler) {
-  TestWithProxies(TestPropertyNames2, [names, handler])
+  TestWithProxies(TestPropertyNames2, handler, names)
 }
 
-function TestPropertyNames2(names_handler, create) {
-  var p = create(names_handler[1])
-  assertArrayEquals(names_handler[0], Object.getOwnPropertyNames(p))
+function TestPropertyNames2(create, handler, names) {
+  var p = create(handler)
+  assertArrayEquals(names, Object.getOwnPropertyNames(p))
 }
 
 TestPropertyNames([], {
   getOwnPropertyNames: function() { return [] }
 })
 
 TestPropertyNames(["a", "zz", " ", "0"], {
   getOwnPropertyNames: function() { return ["a", "zz", " ", 0] }
 })
 
 TestPropertyNames(["throw", "function "], {
   getOwnPropertyNames: function() { return this.getOwnPropertyNames2() },
   getOwnPropertyNames2: function() { return ["throw", "function "] }
 })
 
 TestPropertyNames(["[object Object]"], {
   get getOwnPropertyNames() {
     return function() { return [{}] }
   }
 })
 
 
 function TestPropertyNamesThrow(handler) {
   TestWithProxies(TestPropertyNamesThrow2, handler)
 }
 
-function TestPropertyNamesThrow2(handler, create) {
+function TestPropertyNamesThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.getOwnPropertyNames(p) }, "myexn")
 }
 
 TestPropertyNamesThrow({
   getOwnPropertyNames: function() { throw "myexn" }
 })
 
 TestPropertyNamesThrow({
   getOwnPropertyNames: function() { return this.getOwnPropertyNames2() },
   getOwnPropertyNames2: function() { throw "myexn" }
 })
 
 
 function TestKeys(names, handler) {
-  TestWithProxies(TestKeys2, [names, handler])
+  TestWithProxies(TestKeys2, handler, names)
 }
 
-function TestKeys2(names_handler, create) {
-  var p = create(names_handler[1])
-  assertArrayEquals(names_handler[0], Object.keys(p))
+function TestKeys2(create, handler, names) {
+  var p = create(handler)
+  assertArrayEquals(names, Object.keys(p))
 }
 
 TestKeys([], {
   keys: function() { return [] }
 })
 
 TestKeys(["a", "zz", " ", "0"], {
   keys: function() { return ["a", "zz", " ", 0] }
 })
 
@@ skipping 36 matching lines @@
     return function() { return ["a", "b", "c"] }
   },
   getOwnPropertyDescriptor: function(k) { return {} }
 })
 
 
 function TestKeysThrow(handler) {
   TestWithProxies(TestKeysThrow2, handler)
 }
 
-function TestKeysThrow2(handler, create) {
+function TestKeysThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.keys(p) }, "myexn")
 }
 
 TestKeysThrow({
   keys: function() { throw "myexn" }
 })
 
 TestKeysThrow({
   keys: function() { return this.keys2() },
@@ skipping 156 matching lines @@
 
 TestFixFunction(Object.seal)
 TestFixFunction(Object.freeze)
 TestFixFunction(Object.preventExtensions)
 
 
 function TestFixThrow(handler) {
   TestWithProxies(TestFixThrow2, handler)
 }
 
-function TestFixThrow2(handler) {
-  var p = Proxy.create(handler, {})
+function TestFixThrow2(create, handler) {
+  var p = create(handler, {})
   assertThrows(function(){ Object.seal(p) }, "myexn")
   assertThrows(function(){ Object.freeze(p) }, "myexn")
   assertThrows(function(){ Object.preventExtensions(p) }, "myexn")
 }
 
 TestFixThrow({
   fix: function() { throw "myexn" }
 })
 
 TestFixThrow({
   fix: function() { return this.fix2() },
   fix2: function() { throw "myexn" }
 })
 
 TestFixThrow({
   get fix() { throw "myexn" }
 })
 
 TestFixThrow({
   get fix() {
     return function() { throw "myexn" }
   }
 })
 
 
+// Freeze a proxy in the middle of operations on it.
+// TODO(rossberg): actual behaviour not specified consistently at the moment,
+// just make sure that we do not crash.
+function TestReentrantFix(f) {
+  TestWithProxies(f, Object.freeze)
+  TestWithProxies(f, Object.seal)
+  TestWithProxies(f, Object.preventExtensions)
+}
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    get get() { freeze(p); return undefined },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while getting get trap.
+  try { p.x } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    get: function() { freeze(p); return 3 },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while executing get trap.
+  try { p.x } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    getPropertyDescriptor: function() { freeze(p); return undefined },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while executing default get trap.
+  try { p.x } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    getPropertyDescriptor: function() { freeze(p); return {get: function(){}} },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  var o = Object.create(p)
+  // Freeze while getting a property from prototype.
+  try { o.x } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    get set() { freeze(p); return undefined },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while getting set trap.
+  try { p.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    set: function() { freeze(p); return true },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while executing set trap.
+  try { p.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    getOwnPropertyDescriptor: function() { freeze(p); return undefined },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  // Freeze while executing default set trap.
+  try { p.x } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    getPropertyDescriptor: function() { freeze(p); return {set: function(){}} },
+    fix: function() { return {} }
+  }
+  var p = create(handler)
+  var o = Object.create(p)
+  // Freeze while setting a property in prototype, dropping the property!
+  try { o.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    getPropertyDescriptor: function() { freeze(p); return {set: function(){}} },
+    fix: function() { return {x: {get: function(){}}} }
+  }
+  var p = create(handler)
+  var o = Object.create(p)
+  // Freeze while setting a property in prototype, making it read-only!
+  try { o.x = 4 } catch (e) { assertInstanceof(e, Error) }
+})
+
+
+//TestReentrantFix(function(create, freeze) {
+var h = { getPropertyDescriptor: function() { Object.freeze(p); return {set: function() {}} }, fix: function() { return {x: {get: function() { return 5 }}} }}; var p = Proxy.create(h); var o = Object.create(p); try { o.x = 4 } catch (e) {e2=e}
+//})
+
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    get fix() { freeze(p); return function(){} }
+  }
+  var p = create(handler)
+  // Freeze while getting fix trap.
+  try { Object.freeze(p) } catch (e) { assertInstanceof(e, Error) }
+  p = create(handler)
+  try { Object.seal(p) } catch (e) { assertInstanceof(e, Error) }
+  p = create(handler)
+  try { Object.preventExtensions(p) } catch (e) { assertInstanceof(e, Error) }
+})
+
+TestReentrantFix(function(create, freeze) {
+  var handler = {
+    fix: function() { freeze(p); return {} }
+  }
+  var p = create(handler)
+  // Freeze while executing fix trap.
+  try { Object.freeze(p) } catch (e) { assertInstanceof(e, Error) }
+  p = create(handler)
+  try { Object.seal(p) } catch (e) { assertInstanceof(e, Error) }
+  p = create(handler)
+  try { Object.preventExtensions(p) } catch (e) { assertInstanceof(e, Error) }
+})
+
+
 
 // String conversion (Object.prototype.toString,
 //                    Object.prototype.toLocaleString,
 //                    Function.prototype.toString)
 
 var key
 
 function TestToString(handler) {
   var p = Proxy.create(handler)
   key = ""
@@ skipping 72 matching lines @@
 }))
 
 
 
 // Value conversion (Object.prototype.toValue)
 
 function TestValueOf(handler) {
   TestWithProxies(TestValueOf2, handler)
 }
 
-function TestValueOf2(handler, create) {
+function TestValueOf2(create, handler) {
   var p = create(handler)
   assertSame(p, Object.prototype.valueOf.call(p))
 }
 
 TestValueOf({})
 
 
 
 // Enumerability (Object.prototype.propertyIsEnumerable)
 
 var key
 
 function TestIsEnumerable(handler) {
   TestWithProxies(TestIsEnumerable2, handler)
 }
 
-function TestIsEnumerable2(handler, create) {
+function TestIsEnumerable2(create, handler) {
   var p = create(handler)
   assertTrue(Object.prototype.propertyIsEnumerable.call(p, "a"))
   assertEquals("a", key)
   assertTrue(Object.prototype.propertyIsEnumerable.call(p, 2))
   assertEquals("2", key)
   assertFalse(Object.prototype.propertyIsEnumerable.call(p, "z"))
   assertEquals("z", key)
 
   var o = Object.create(p)
   key = ""
@@ skipping 28 matching lines @@
       key = k; return {enumerable: k < "z", configurable: true}
     }
   }
 }))
 
 
 function TestIsEnumerableThrow(handler) {
   TestWithProxies(TestIsEnumerableThrow2, handler)
 }
 
-function TestIsEnumerableThrow2(handler, create) {
+function TestIsEnumerableThrow2(create, handler) {
   var p = create(handler)
   assertThrows(function(){ Object.prototype.propertyIsEnumerable.call(p, "a") },
     "myexn")
   assertThrows(function(){ Object.prototype.propertyIsEnumerable.call(p, 11) },
     "myexn")
 }
 
 TestIsEnumerableThrow({
   getOwnPropertyDescriptor: function(k) { throw "myexn" }
 })
@@ skipping 365 matching lines @@
 
 TestAccessorCall(
   Proxy.createFunction({}, function() { receiver = this; return 42 }),
   Proxy.createFunction({}, function(x) { receiver = this; value = x })
 )
 
 TestAccessorCall(
   CreateFrozen({}, function() { receiver = this; return 42 }),
   CreateFrozen({}, function(x) { receiver = this; value = x })
 )