Merge up to 8597 to experimental/gc from the bleeding edge.

src/proxy.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 42 matching lines @@
   "constructTrap",
 ]
 
 $Proxy.createFunction = function(handler, callTrap, constructTrap) {
   handler.callTrap = callTrap
   handler.constructTrap = constructTrap
   $Proxy.create(handler)
 }
 
 $Proxy.create = function(handler, proto) {
-  if (!IS_SPEC_OBJECT(proto)) proto = $Object.prototype
+  if (!IS_SPEC_OBJECT(handler))
+    throw MakeTypeError("handler_non_object", ["create"])
+  if (!IS_SPEC_OBJECT(proto)) proto = null  // Mozilla does this...
   return %CreateJSProxy(handler, proto)
 }
 
 
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Builtins
 ////////////////////////////////////////////////////////////////////////////////
 
 function DerivedGetTrap(receiver, name) {
   var desc = this.getPropertyDescriptor(name)
-  if (IS_UNDEFINED(desc)) { return desc; }
+  if (IS_UNDEFINED(desc)) { return desc }
   if ('value' in desc) {
     return desc.value
   } else {
-    if (IS_UNDEFINED(desc.get)) { return desc.get; }
-    return desc.get.call(receiver)  // The proposal says so...
+    if (IS_UNDEFINED(desc.get)) { return desc.get }
+    // The proposal says: desc.get.call(receiver)
+    return %_CallFunction(receiver, desc.get)
   }
 }
+
+function DerivedSetTrap(receiver, name, val) {
+  var desc = this.getOwnPropertyDescriptor(name)
+  if (desc) {
+    if ('writable' in desc) {
+      if (desc.writable) {
+        desc.value = val
+        this.defineProperty(name, desc)
+        return true
+      } else {
+        return false
+      }
+    } else { // accessor
+      if (desc.set) {
+        // The proposal says: desc.set.call(receiver, val)
+        %_CallFunction(receiver, val, desc.set)
+        return true
+      } else {
+        return false
+      }
+    }
+  }
+  desc = this.getPropertyDescriptor(name)
+  if (desc) {
+    if ('writable' in desc) {
+      if (desc.writable) {
+        // fall through
+      } else {
+        return false
+      }
+    } else { // accessor
+      if (desc.set) {
+        // The proposal says: desc.set.call(receiver, val)
+        %_CallFunction(receiver, val, desc.set)
+        return true
+      } else {
+        return false
+      }
+    }
+  }
+  this.defineProperty(name, {
+    value: val,
+    writable: true,
+    enumerable: true,
+    configurable: true});
+  return true;
+}
+
+function DerivedHasTrap(name) {
+  return !!this.getPropertyDescriptor(name)
+}