Mark proxy map as unstable during fixing freezing, sealing or preventing extensions).

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index f4b609a7f94fd882faacfe89847d8c495cf58456..418f727d66180869654e58889b896b741eee1c42 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1984,6 +1984,9 @@ Handle<JSProxy> Factory::NewJSProxy(Handle<Object> handler,
   // maps. Will probably depend on the identity of the handler object, too.
   Handle<Map> map = NewMap(JS_PROXY_TYPE, JSProxy::kSize);
   Map::SetPrototype(map, prototype);
+  // Do not treat proxy maps as stable since a proxy object may silently turn
+  // into a JSObject by freezing, sealing or preventing extensions.
+  map->mark_unstable();

[Toon Verwaest, 2015/05/29 14:12:52]

Why not make it unstable in those places?

 
   // Allocate the proxy object.
   Handle<JSProxy> result = New<JSProxy>(map, NEW_SPACE);