Throw TypeError when reading global references through a JSProxy

test/mjsunit/harmony/proxies-global-reference.js

Index: test/mjsunit/harmony/proxies-global-reference.js
diff --git a/test/mjsunit/compiler/regress-445876.js b/test/mjsunit/harmony/proxies-global-reference.js
similarity index 53%
copy from test/mjsunit/compiler/regress-445876.js
copy to test/mjsunit/harmony/proxies-global-reference.js
index 30e10e56c3ac424fb8843b700bec2af5ded334ac..cdc9fde1c5492a30f9781bcf7453ad0700f79d8e 100644
--- a/test/mjsunit/compiler/regress-445876.js
+++ b/test/mjsunit/harmony/proxies-global-reference.js
@@ -2,11 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --harmony-proxies
 
-function f(x) {
-  while (1) { s++; }
-  while (x) { s++; }
-}
+__proto__ = new Proxy({}, new Proxy({}, {

[adamk, 2015/12/17 13:36:41]

Maybe also add a test case where Object.prototype is the thing modified? That'll
show that we're not just tracking [[Prototype]] changes on the global itself.

+  get() { throw "No trap should fire" }}));
 
-assertThrows(function () { f(1); });
+assertThrows(()=>a, TypeError);