Move properties from JSObject to JSReceiver

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index 847a1f48baa1928e660b4a49718da5878f54b4aa..4701c2154d0efacaed35e0ef433de5145de18775 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -2025,6 +2025,7 @@ Handle<JSProxy> Factory::NewJSProxy(Handle<JSReceiver> target,
   }
   DCHECK(map->prototype()->IsNull());
   Handle<JSProxy> result = New<JSProxy>(map, NEW_SPACE);
+  result->initialize_properties();

[jochen (gone - plz use gerrit), 2016/01/12 14:51:05]

is there any other way to allocate a JSProxy? some inline assembly or hydrogen
hidden somewhere?

[Toon Verwaest, 2016/01/12 15:03:25]

Not afaik

   result->set_target(*target);
   result->set_handler(*handler);
   result->set_hash(*undefined_value(), SKIP_WRITE_BARRIER);