Mark proxy map as unstable during fixing freezing, sealing or preventing extensions).

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
 #include "src/conversions.h"
@@ skipping 1966 matching lines @@
 }
 
 
 Handle<JSProxy> Factory::NewJSProxy(Handle<Object> handler,
                                     Handle<Object> prototype) {
   // Allocate map.
   // TODO(rossberg): Once we optimize proxies, think about a scheme to share
   // maps. Will probably depend on the identity of the handler object, too.
   Handle<Map> map = NewMap(JS_PROXY_TYPE, JSProxy::kSize);
   Map::SetPrototype(map, prototype);
+  // Do not treat proxy maps as stable since a proxy object may silently turn
+  // into a JSObject by freezing, sealing or preventing extensions.
+  map->mark_unstable();

[Toon Verwaest, 2015/05/29 14:12:52]

Why not make it unstable in those places?

 
   // Allocate the proxy object.
   Handle<JSProxy> result = New<JSProxy>(map, NEW_SPACE);
   result->InitializeBody(map->instance_size(), Smi::FromInt(0));
   result->set_handler(*handler);
   result->set_hash(*undefined_value(), SKIP_WRITE_BARRIER);
   return result;
 }
 
 
@@ skipping 467 matching lines @@
   return Handle<Object>::null();
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 } }  // namespace v8::internal