Title: [196722] trunk/Source
Revision
196722
Author
[email protected]
Date
2016-02-17 14:11:39 -0800 (Wed, 17 Feb 2016)

Log Message

Implement Proxy [[Get]]
https://bugs.webkit.org/show_bug.cgi?id=154081

Reviewed by Michael Saboff.

Source/_javascript_Core:

This patch implements ProxyObject and ProxyConstructor. Their
implementations are straight forward and follow the spec.
The largest change in this patch is adding a second parameter
to PropertySlot's constructor that specifies the internal method type of
the getOwnPropertySlot inquiry. We use getOwnPropertySlot to 
implement more than one Internal Method in the spec. Because 
of this, we need InternalMethodType to give us context about 
which Internal Method we're executing. Specifically, Proxy will 
call into different handlers based on this information.

InternalMethodType is an enum with the following values:
- Get
  This corresponds to [[Get]] internal method in the spec.
- GetOwnProperty
  This corresponds to [[GetOwnProperty]] internal method in the spec.
- HasProperty
  This corresponds to [[HasProperty]] internal method in the spec.
- VMInquiry
  This is basically everything else that isn't one of the above
  types. This value also mandates that getOwnPropertySlot does
  not perform any user observable effects. I.e, it can't call
  a JS function.

The other non-VMInquiry InternalMethodTypes are allowed to perform user
observable effects. I.e, in future patches, ProxyObject will implement
InternalMethodType::HasProperty and InternalMethodType::GetOwnProperty, which will both be defined
to call user defined JS functions, which clearly have the right to perform
user observable effects.

This patch implements getOwnPropertySlot of ProxyObject under
InternalMethodType::Get. 

* API/JSCallbackObjectFunctions.h:
(JSC::JSCallbackObject<Parent>::put):
(JSC::JSCallbackObject<Parent>::staticFunctionGetter):
* CMakeLists.txt:
* _javascript_Core.xcodeproj/project.pbxproj:
* debugger/DebuggerScope.cpp:
(JSC::DebuggerScope::caughtValue):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ArrayPrototype.cpp:
(JSC::getProperty):
* runtime/CommonIdentifiers.h:
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::get):
* runtime/JSFunction.cpp:
(JSC::JSFunction::getOwnNonIndexPropertyNames):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewWithArguments):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::defineOwnProperty):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::regExpMatchesArrayStructure):
(JSC::JSGlobalObject::moduleRecordStructure):
(JSC::JSGlobalObject::moduleNamespaceObjectStructure):
(JSC::JSGlobalObject::proxyObjectStructure):
(JSC::JSGlobalObject::wasmModuleStructure):
* runtime/JSModuleEnvironment.cpp:
(JSC::JSModuleEnvironment::getOwnPropertySlot):
* runtime/JSModuleNamespaceObject.cpp:
(JSC::callbackGetter):
* runtime/JSONObject.cpp:
(JSC::Stringifier::Holder::appendNextProperty):
(JSC::Walker::walk):
* runtime/JSObject.cpp:
(JSC::JSObject::calculatedClassName):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::hasProperty):
(JSC::JSObject::deleteProperty):
(JSC::JSObject::hasOwnProperty):
(JSC::JSObject::getOwnPropertyDescriptor):
* runtime/JSObject.h:
(JSC::JSObject::getDirectIndex):
(JSC::JSObject::get):
* runtime/JSScope.cpp:
(JSC::abstractAccess):
* runtime/ObjectConstructor.cpp:
(JSC::toPropertyDescriptor):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
(JSC::objectProtoFuncToString):
* runtime/PropertySlot.h:
(JSC::attributesForStructure):
(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::internalMethodType):
(JSC::PropertySlot::disableCaching):
(JSC::PropertySlot::getValue):
* runtime/ProxyConstructor.cpp: Added.
(JSC::ProxyConstructor::create):
(JSC::ProxyConstructor::ProxyConstructor):
(JSC::ProxyConstructor::finishCreation):
(JSC::constructProxyObject):
(JSC::ProxyConstructor::getConstructData):
(JSC::ProxyConstructor::getCallData):
* runtime/ProxyConstructor.h: Added.
(JSC::ProxyConstructor::createStructure):
* runtime/ProxyObject.cpp: Added.
(JSC::ProxyObject::ProxyObject):
(JSC::ProxyObject::finishCreation):
(JSC::performProxyGet):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::getOwnPropertySlot):
(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::visitChildren):
* runtime/ProxyObject.h: Added.
(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):
(JSC::ProxyObject::target):
(JSC::ProxyObject::handler):
* runtime/ReflectObject.cpp:
(JSC::reflectObjectGet):
* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::StackFrame::nameFromCallee):
* tests/es6.yaml:
* tests/stress/proxy-basic.js: Added.
(assert):
(let.handler.get null):
(get let):
(let.handler.get switch):
(let.handler):
(let.theTarget.get x):
* tests/stress/proxy-in-proto-chain.js: Added.
(assert):
* tests/stress/proxy-of-a-proxy.js: Added.
(assert):
(throw.new.Error.):
* tests/stress/proxy-property-descriptor.js: Added.
(assert):
(set Object):
* wasm/WASMModuleParser.cpp:
(JSC::WASMModuleParser::getImportedValue):

Source/WebCore:

Tests are in _javascript_Core.

* bindings/js/JSCryptoAlgorithmDictionary.cpp:
(WebCore::getProperty):
(WebCore::getHashAlgorithm):
* bindings/js/JSCryptoKeySerializationJWK.cpp:
(WebCore::getJSArrayFromJSON):
(WebCore::getStringFromJSON):
(WebCore::getBooleanFromJSON):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::DialogHandler::returnValue):
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::tryGetProperty):
* bindings/js/JSStorageCustom.cpp:
(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::deletePropertyByIndex):
(WebCore::JSStorage::putDelegate):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::getProperty):
* testing/Internals.cpp:
(WebCore::Internals::isReadableStreamDisturbed):

Modified Paths

Added Paths

Diff

Modified: trunk/Source/_javascript_Core/API/JSCallbackObjectFunctions.h (196721 => 196722)


--- trunk/Source/_javascript_Core/API/JSCallbackObjectFunctions.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/API/JSCallbackObjectFunctions.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -268,7 +268,7 @@
             
             if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
                 if (StaticFunctionEntry* entry = staticFunctions->get(name)) {
-                    PropertySlot getSlot(thisObject);
+                    PropertySlot getSlot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
                     if (Parent::getOwnPropertySlot(thisObject, exec, propertyName, getSlot))
                         return Parent::put(thisObject, exec, propertyName, value, slot);
                     if (entry->attributes & kJSPropertyAttributeReadOnly)
@@ -605,7 +605,7 @@
     JSCallbackObject* thisObj = asCallbackObject(thisValue);
     
     // Check for cached or override property.
-    PropertySlot slot2(thisObj);
+    PropertySlot slot2(thisObj, PropertySlot::InternalMethodType::VMInquiry);
     if (Parent::getOwnPropertySlot(thisObj, exec, propertyName, slot2))
         return JSValue::encode(slot2.getValue(exec, propertyName));
 

Modified: trunk/Source/_javascript_Core/CMakeLists.txt (196721 => 196722)


--- trunk/Source/_javascript_Core/CMakeLists.txt	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/CMakeLists.txt	2016-02-17 22:11:39 UTC (rev 196722)
@@ -736,6 +736,8 @@
     runtime/PropertySlot.cpp
     runtime/PropertyTable.cpp
     runtime/PrototypeMap.cpp
+    runtime/ProxyConstructor.cpp
+    runtime/ProxyObject.cpp
     runtime/ReflectObject.cpp
     runtime/RegExp.cpp
     runtime/RegExpCache.cpp

Modified: trunk/Source/_javascript_Core/ChangeLog (196721 => 196722)


--- trunk/Source/_javascript_Core/ChangeLog	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-02-17 22:11:39 UTC (rev 196722)
@@ -1,3 +1,152 @@
+2016-02-17  Saam barati  <[email protected]>
+
+        Implement Proxy [[Get]]
+        https://bugs.webkit.org/show_bug.cgi?id=154081
+
+        Reviewed by Michael Saboff.
+
+        This patch implements ProxyObject and ProxyConstructor. Their
+        implementations are straight forward and follow the spec.
+        The largest change in this patch is adding a second parameter
+        to PropertySlot's constructor that specifies the internal method type of
+        the getOwnPropertySlot inquiry. We use getOwnPropertySlot to 
+        implement more than one Internal Method in the spec. Because 
+        of this, we need InternalMethodType to give us context about 
+        which Internal Method we're executing. Specifically, Proxy will 
+        call into different handlers based on this information.
+
+        InternalMethodType is an enum with the following values:
+        - Get
+          This corresponds to [[Get]] internal method in the spec.
+        - GetOwnProperty
+          This corresponds to [[GetOwnProperty]] internal method in the spec.
+        - HasProperty
+          This corresponds to [[HasProperty]] internal method in the spec.
+        - VMInquiry
+          This is basically everything else that isn't one of the above
+          types. This value also mandates that getOwnPropertySlot does
+          not perform any user observable effects. I.e, it can't call
+          a JS function.
+
+        The other non-VMInquiry InternalMethodTypes are allowed to perform user
+        observable effects. I.e, in future patches, ProxyObject will implement
+        InternalMethodType::HasProperty and InternalMethodType::GetOwnProperty, which will both be defined
+        to call user defined JS functions, which clearly have the right to perform
+        user observable effects.
+
+        This patch implements getOwnPropertySlot of ProxyObject under
+        InternalMethodType::Get. 
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        * CMakeLists.txt:
+        * _javascript_Core.xcodeproj/project.pbxproj:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::caughtValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::get):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        (JSC::JSGlobalObject::moduleRecordStructure):
+        (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
+        (JSC::JSGlobalObject::proxyObjectStructure):
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::getOwnPropertySlot):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::callbackGetter):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::hasOwnProperty):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectIndex):
+        (JSC::JSObject::get):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/PropertySlot.h:
+        (JSC::attributesForStructure):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::internalMethodType):
+        (JSC::PropertySlot::disableCaching):
+        (JSC::PropertySlot::getValue):
+        * runtime/ProxyConstructor.cpp: Added.
+        (JSC::ProxyConstructor::create):
+        (JSC::ProxyConstructor::ProxyConstructor):
+        (JSC::ProxyConstructor::finishCreation):
+        (JSC::constructProxyObject):
+        (JSC::ProxyConstructor::getConstructData):
+        (JSC::ProxyConstructor::getCallData):
+        * runtime/ProxyConstructor.h: Added.
+        (JSC::ProxyConstructor::createStructure):
+        * runtime/ProxyObject.cpp: Added.
+        (JSC::ProxyObject::ProxyObject):
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::getOwnPropertySlot):
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h: Added.
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        (JSC::ProxyObject::target):
+        (JSC::ProxyObject::handler):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGet):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        * tests/es6.yaml:
+        * tests/stress/proxy-basic.js: Added.
+        (assert):
+        (let.handler.get null):
+        (get let):
+        (let.handler.get switch):
+        (let.handler):
+        (let.theTarget.get x):
+        * tests/stress/proxy-in-proto-chain.js: Added.
+        (assert):
+        * tests/stress/proxy-of-a-proxy.js: Added.
+        (assert):
+        (throw.new.Error.):
+        * tests/stress/proxy-property-descriptor.js: Added.
+        (assert):
+        (set Object):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::getImportedValue):
+
 2016-02-17  Mark Lam  <[email protected]>
 
         StringPrototype functions should check for exceptions after calling JSString::value().

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (196721 => 196722)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2016-02-17 22:11:39 UTC (rev 196722)
@@ -1318,6 +1318,10 @@
 		797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */; };
 		797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B00CBC1C6AB07E0088C65D /* ProxyConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */; };
+		79B00CBD1C6AB07E0088C65D /* ProxyConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B00CBE1C6AB07E0088C65D /* ProxyObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */; };
+		79B00CBF1C6AB07E0088C65D /* ProxyObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B00CBB1C6AB07E0088C65D /* ProxyObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		79C4B15D1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */; };
 		79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */ = {isa = PBXBuildFile; fileRef = 79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3525,6 +3529,10 @@
 		797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalLexicalEnvironment.cpp; sourceTree = "<group>"; };
 		797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalLexicalEnvironment.h; sourceTree = "<group>"; };
 		799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PCToOriginMap.h; path = b3/B3PCToOriginMap.h; sourceTree = "<group>"; };
+		79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyConstructor.cpp; sourceTree = "<group>"; };
+		79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyConstructor.h; sourceTree = "<group>"; };
+		79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyObject.cpp; sourceTree = "<group>"; };
+		79B00CBB1C6AB07E0088C65D /* ProxyObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyObject.h; sourceTree = "<group>"; };
 		79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLiveCatchVariablePreservationPhase.cpp; path = dfg/DFGLiveCatchVariablePreservationPhase.cpp; sourceTree = "<group>"; };
 		79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLiveCatchVariablePreservationPhase.h; path = dfg/DFGLiveCatchVariablePreservationPhase.h; sourceTree = "<group>"; };
 		79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntPCRanges.h; path = llint/LLIntPCRanges.h; sourceTree = "<group>"; };
@@ -6008,6 +6016,10 @@
 				65C02FBB0637462A003E7EE6 /* Protect.h */,
 				14D844A216AA2C7000A65AF0 /* PrototypeMap.cpp */,
 				14D844A316AA2C7000A65AF0 /* PrototypeMap.h */,
+				79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */,
+				79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */,
+				79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */,
+				79B00CBB1C6AB07E0088C65D /* ProxyObject.h */,
 				0F5780A118FE1E98001E72D9 /* PureNaN.h */,
 				0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */,
 				147B84620E6DE6B1004775A4 /* PutPropertySlot.h */,
@@ -7061,7 +7073,9 @@
 				0FEC85761BDACDC70080FF74 /* AirCode.h in Headers */,
 				0F3730931C0D67EE00052BFA /* AirUseCounts.h in Headers */,
 				0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */,
+				79B00CBD1C6AB07E0088C65D /* ProxyConstructor.h in Headers */,
 				799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */,
+				79B00CBF1C6AB07E0088C65D /* ProxyObject.h in Headers */,
 				792CB34A1C4EED5C00D13AF3 /* PCToCodeOriginMap.h in Headers */,
 				79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */,
 				79D5CD5B1C1106A900CECA07 /* SamplingProfiler.h in Headers */,
@@ -8953,6 +8967,7 @@
 				A77A423F17A0BBFD00A8DB81 /* DFGClobberize.cpp in Sources */,
 				A77A424117A0BBFD00A8DB81 /* DFGClobberSet.cpp in Sources */,
 				0F3C1F1A1B868E7900ABB08B /* DFGClobbersExitState.cpp in Sources */,
+				79B00CBC1C6AB07E0088C65D /* ProxyConstructor.cpp in Sources */,
 				0F04396D1B03DC0B009598B7 /* DFGCombinedLiveness.cpp in Sources */,
 				0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */,
 				0FEA0A31170D40BF00BB722C /* DFGCommonData.cpp in Sources */,
@@ -9014,6 +9029,7 @@
 				46D4DCBD1C5AB2D500D8D321 /* JSBoundSlotBaseFunction.cpp in Sources */,
 				0FF2CD5B1B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp in Sources */,
 				A737810D1799EA2E00817533 /* DFGNaturalLoops.cpp in Sources */,
+				79B00CBE1C6AB07E0088C65D /* ProxyObject.cpp in Sources */,
 				792CB3491C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp in Sources */,
 				0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */,
 				0FB3878F1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp in Sources */,

Modified: trunk/Source/_javascript_Core/debugger/DebuggerScope.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/debugger/DebuggerScope.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/debugger/DebuggerScope.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -209,7 +209,7 @@
     SymbolTable* catchSymbolTable = catchEnvironment->symbolTable();
     RELEASE_ASSERT(catchSymbolTable->size() == 1);
     PropertyName errorName(catchSymbolTable->begin(catchSymbolTable->m_lock)->key.get());
-    PropertySlot slot(m_scope.get());
+    PropertySlot slot(m_scope.get(), PropertySlot::InternalMethodType::Get);
     bool success = catchEnvironment->getOwnPropertySlot(catchEnvironment, exec, errorName, slot);
     RELEASE_ASSERT(success && slot.isValue());
     return slot.getValue(exec, errorName);

Modified: trunk/Source/_javascript_Core/interpreter/Interpreter.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/interpreter/Interpreter.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/interpreter/Interpreter.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -877,7 +877,7 @@
                 switch (JSONPPath[i].m_type) {
                 case JSONPPathEntryTypeDot: {
                     if (i == 0) {
-                        PropertySlot slot(globalObject);
+                        PropertySlot slot(globalObject, PropertySlot::InternalMethodType::Get);
                         if (!globalObject->getPropertySlot(callFrame, JSONPPath[i].m_pathEntryName, slot)) {
                             if (entry)
                                 return callFrame->vm().throwException(callFrame, createUndefinedVariableError(callFrame, JSONPPath[i].m_pathEntryName));
@@ -1225,7 +1225,7 @@
         JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalObject*>(variableObject)->globalLexicalEnvironment();
         for (unsigned i = 0; i < numVariables; ++i) {
             const Identifier& ident = codeBlock->variable(i);
-            PropertySlot slot(globalLexicalEnvironment);
+            PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
             if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, ident, slot)) {
                 return checkedReturn(callFrame->vm().throwException(callFrame,
                     createTypeError(callFrame, makeString("Can't create duplicate global variable in eval: '", String(ident.impl()), "'"))));
@@ -1234,7 +1234,7 @@
 
         for (int i = 0; i < numFunctions; ++i) {
             FunctionExecutable* function = codeBlock->functionDecl(i);
-            PropertySlot slot(globalLexicalEnvironment);
+            PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
             if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, function->name(), slot)) {
                 return checkedReturn(callFrame->vm().throwException(callFrame,
                     createTypeError(callFrame, makeString("Can't create duplicate global variable in eval: '", String(function->name().impl()), "'"))));

Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/jit/JITOperations.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -158,7 +158,7 @@
     stubInfo->tookSlowPath = true;
     
     JSValue baseValue = JSValue::decode(base);
-    PropertySlot slot(baseValue);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
     Identifier ident = Identifier::fromUid(vm, uid);
     return JSValue::encode(baseValue.get(exec, ident, slot));
 }
@@ -169,7 +169,7 @@
     NativeCallFrameTracer tracer(vm, exec);
     
     JSValue baseValue = JSValue::decode(base);
-    PropertySlot slot(baseValue);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
     Identifier ident = Identifier::fromUid(vm, uid);
     return JSValue::encode(baseValue.get(exec, ident, slot));
 }
@@ -181,7 +181,7 @@
     Identifier ident = Identifier::fromUid(vm, uid);
 
     JSValue baseValue = JSValue::decode(base);
-    PropertySlot slot(baseValue);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
     
     bool hasResult = baseValue.getPropertySlot(exec, ident, slot);
     if (stubInfo->considerCaching())
@@ -203,7 +203,7 @@
     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 
     Identifier ident = Identifier::fromUid(vm, key);
-    PropertySlot slot(base);
+    PropertySlot slot(base, PropertySlot::InternalMethodType::HasProperty);
     bool result = asObject(base)->getPropertySlot(exec, ident, slot);
     
     RELEASE_ASSERT(accessType == stubInfo->accessType);
@@ -1885,7 +1885,7 @@
     // ModuleVar is always converted to ClosureVar for get_from_scope.
     ASSERT(getPutInfo.resolveType() != ModuleVar);
 
-    PropertySlot slot(scope);
+    PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
     if (!scope->getPropertySlot(exec, ident, slot)) {
         if (getPutInfo.resolveMode() == ThrowIfNotFound)
             vm.throwException(exec, createUndefinedVariableError(exec, ident));
@@ -1937,7 +1937,7 @@
         && jsDynamicCast<JSGlobalLexicalEnvironment*>(scope)
         && getPutInfo.initializationMode() != Initialization) {
         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
-        PropertySlot slot(scope);
+        PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
         if (slot.getValue(exec, ident) == jsTDZValue()) {
             exec->vm().throwException(exec, createTDZError(exec));

Modified: trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -551,7 +551,7 @@
     CodeBlock* codeBlock = exec->codeBlock();
     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
     JSValue baseValue = LLINT_OP_C(2).jsValue();
-    PropertySlot slot(baseValue);
+    PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::Get);
 
     JSValue result = baseValue.get(exec, ident, slot);
     LLINT_CHECK_EXCEPTION();
@@ -602,7 +602,7 @@
     CodeBlock* codeBlock = exec->codeBlock();
     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
     JSValue baseValue = LLINT_OP(2).jsValue();
-    PropertySlot slot(baseValue);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
     LLINT_RETURN(baseValue.get(exec, ident, slot));
 }
 
@@ -1413,7 +1413,7 @@
     // ModuleVar is always converted to ClosureVar for get_from_scope.
     ASSERT(getPutInfo.resolveType() != ModuleVar);
 
-    PropertySlot slot(scope);
+    PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
     if (!scope->getPropertySlot(exec, ident, slot)) {
         if (getPutInfo.resolveMode() == ThrowIfNotFound)
             LLINT_RETURN(exec->vm().throwException(exec, createUndefinedVariableError(exec, ident)));
@@ -1461,7 +1461,7 @@
         && jsDynamicCast<JSGlobalLexicalEnvironment*>(scope)
         && getPutInfo.initializationMode() != Initialization) {
         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
-        PropertySlot slot(scope);
+        PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
         if (slot.getValue(exec, ident) == jsTDZValue())
             LLINT_THROW(createTDZError(exec));

Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -151,7 +151,7 @@
 {
     if (JSValue result = object->tryGetIndexQuickly(index))
         return result;
-    PropertySlot slot(object);
+    PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
     if (!object->getPropertySlot(exec, index, slot))
         return JSValue();
     return slot.getValue(exec, index);

Modified: trunk/Source/_javascript_Core/runtime/CommonIdentifiers.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/CommonIdentifiers.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/CommonIdentifiers.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -52,6 +52,7 @@
     macro(NumberFormat) \
     macro(Object) \
     macro(Promise) \
+    macro(Proxy) \
     macro(RangeError) \
     macro(ReferenceError) \
     macro(Reflect) \

Modified: trunk/Source/_javascript_Core/runtime/JSCJSValueInlines.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSCJSValueInlines.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSCJSValueInlines.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -705,7 +705,7 @@
 
 ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, PropertyName propertyName) const
 {
-    PropertySlot slot(asValue());
+    PropertySlot slot(asValue(), PropertySlot::InternalMethodType::Get);
     return get(exec, propertyName, slot);
 }
 
@@ -732,7 +732,7 @@
 
 ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(asValue());
+    PropertySlot slot(asValue(), PropertySlot::InternalMethodType::Get);
     return get(exec, propertyName, slot);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/JSFunction.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -430,7 +430,7 @@
     if (!thisObject->isHostOrBuiltinFunction() && mode.includeDontEnumProperties()) {
         VM& vm = exec->vm();
         // Make sure prototype has been reified.
-        PropertySlot slot(thisObject);
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
         thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, vm.propertyNames->prototype, slot);
 
         propertyNames.add(vm.propertyNames->arguments);
@@ -451,7 +451,7 @@
     if (propertyName == exec->propertyNames().prototype) {
         // Make sure prototype has been reified, such that it can only be overwritten
         // following the rules set out in ECMA-262 8.12.9.
-        PropertySlot slot(thisObject);
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
         thisObject->methodTable(exec->vm())->getOwnPropertySlot(thisObject, exec, propertyName, slot);
         if (thisObject->m_rareData)
             thisObject->m_rareData->clear("Store to prototype property of a function");
@@ -501,7 +501,7 @@
     if (propertyName == exec->propertyNames().prototype) {
         // Make sure prototype has been reified, such that it can only be overwritten
         // following the rules set out in ECMA-262 8.12.9.
-        PropertySlot slot(thisObject);
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
         thisObject->methodTable(exec->vm())->getOwnPropertySlot(thisObject, exec, propertyName, slot);
         if (thisObject->m_rareData)
             thisObject->m_rareData->clear("Store to prototype property of a function");
@@ -511,7 +511,7 @@
     bool valueCheck;
     if (propertyName == exec->propertyNames().arguments) {
         if (thisObject->jsExecutable()->isStrictMode()) {
-            PropertySlot slot(thisObject);
+            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
             if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
                 thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(exec->vm()), DontDelete | DontEnum | Accessor);
             return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
@@ -519,7 +519,7 @@
         valueCheck = !descriptor.value() || sameValue(exec, descriptor.value(), retrieveArguments(exec, thisObject));
     } else if (propertyName == exec->propertyNames().caller) {
         if (thisObject->jsExecutable()->isStrictMode()) {
-            PropertySlot slot(thisObject);
+            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
             if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
                 thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(exec->vm()), DontDelete | DontEnum | Accessor);
             return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);

Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -150,7 +150,7 @@
         if (isTypedView(object->classInfo()->typedArrayStorageType))
             length = jsCast<JSArrayBufferView*>(object)->length();
         else {
-            PropertySlot lengthSlot(object);
+            PropertySlot lengthSlot(object, PropertySlot::InternalMethodType::Get);
             object->getPropertySlot(exec, vm.propertyNames->length, lengthSlot);
 
             JSValue iteratorFunc = object->get(exec, vm.propertyNames->iteratorSymbol);

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -128,6 +128,8 @@
 #include "ObjectConstructor.h"
 #include "ObjectPrototype.h"
 #include "ParserError.h"
+#include "ProxyConstructor.h"
+#include "ProxyObject.h"
 #include "ReflectObject.h"
 #include "RegExpConstructor.h"
 #include "RegExpMatchesArray.h"
@@ -366,6 +368,7 @@
 
     m_moduleRecordStructure.set(vm, this, JSModuleRecord::createStructure(vm, this, m_objectPrototype.get()));
     m_moduleNamespaceObjectStructure.set(vm, this, JSModuleNamespaceObject::createStructure(vm, this, jsNull()));
+    m_proxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, m_objectPrototype.get()));
     
 #if ENABLE(WEBASSEMBLY)
     m_wasmModuleStructure.set(vm, this, JSWASMModule::createStructure(vm, this));
@@ -454,6 +457,8 @@
     putDirectWithoutTransition(vm, vm.propertyNames->SyntaxError, m_syntaxErrorConstructor.get(), DontEnum);
     putDirectWithoutTransition(vm, vm.propertyNames->TypeError, m_typeErrorConstructor.get(), DontEnum);
     putDirectWithoutTransition(vm, vm.propertyNames->URIError, m_URIErrorConstructor.get(), DontEnum);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->Proxy, ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, this, m_functionPrototype.get())), DontEnum);
     
     
 #define PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
@@ -626,7 +631,7 @@
 bool JSGlobalObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
 {
     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
-    PropertySlot slot(thisObject);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
     // silently ignore attempts to add accessors aliasing vars.
     if (descriptor.isAccessorDescriptor() && symbolTableGet(thisObject, propertyName, slot))
         return false;

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -277,6 +277,7 @@
     WriteBarrier<Structure> m_regExpMatchesArrayStructure;
     WriteBarrier<Structure> m_moduleRecordStructure;
     WriteBarrier<Structure> m_moduleNamespaceObjectStructure;
+    WriteBarrier<Structure> m_proxyObjectStructure;
 #if ENABLE(WEBASSEMBLY)
     WriteBarrier<Structure> m_wasmModuleStructure;
 #endif
@@ -528,6 +529,7 @@
     Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
     Structure* moduleRecordStructure() const { return m_moduleRecordStructure.get(); }
     Structure* moduleNamespaceObjectStructure() const { return m_moduleNamespaceObjectStructure.get(); }
+    Structure* proxyObjectStructure() const { return m_proxyObjectStructure.get(); }
 #if ENABLE(WEBASSEMBLY)
     Structure* wasmModuleStructure() const { return m_wasmModuleStructure.get(); }
 #endif

Modified: trunk/Source/_javascript_Core/runtime/JSModuleEnvironment.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSModuleEnvironment.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSModuleEnvironment.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -83,7 +83,7 @@
     if (resolution.type == JSModuleRecord::Resolution::Type::Resolved) {
         // When resolveImport resolves the resolution, the imported module environment must have the binding.
         JSModuleEnvironment* importedModuleEnvironment = resolution.moduleRecord->moduleEnvironment();
-        PropertySlot redirectSlot(importedModuleEnvironment);
+        PropertySlot redirectSlot(importedModuleEnvironment, PropertySlot::InternalMethodType::Get);
         bool result = importedModuleEnvironment->methodTable(exec->vm())->getOwnPropertySlot(importedModuleEnvironment, exec, resolution.localName, redirectSlot);
         ASSERT_UNUSED(result, result);
         ASSERT(redirectSlot.isValue());

Modified: trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -106,7 +106,7 @@
     JSModuleRecord* targetModule = resolution.moduleRecord;
     JSModuleEnvironment* targetEnvironment = targetModule->moduleEnvironment();
 
-    PropertySlot trampolineSlot(targetEnvironment);
+    PropertySlot trampolineSlot(targetEnvironment, PropertySlot::InternalMethodType::Get);
     if (!targetEnvironment->methodTable(exec->vm())->getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot))
         return JSValue::encode(jsUndefined());
 

Modified: trunk/Source/_javascript_Core/runtime/JSONObject.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -466,7 +466,7 @@
         if (m_isJSArray && asArray(m_object.get())->canGetIndexQuickly(index))
             value = asArray(m_object.get())->getIndexQuickly(index);
         else {
-            PropertySlot slot(m_object.get());
+            PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
             if (m_object->methodTable()->getOwnPropertySlotByIndex(m_object.get(), exec, index, slot)) {
                 value = slot.getValue(exec, index);
                 if (exec->hadException())
@@ -484,7 +484,7 @@
         stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object.get(), index);
     } else {
         // Get the value.
-        PropertySlot slot(m_object.get());
+        PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
         Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
         if (!m_object->methodTable()->getOwnPropertySlot(m_object.get(), exec, propertyName, slot))
             return true;
@@ -618,7 +618,7 @@
                 if (isJSArray(array) && array->canGetIndexQuickly(index))
                     inValue = array->getIndexQuickly(index);
                 else {
-                    PropertySlot slot(array);
+                    PropertySlot slot(array, PropertySlot::InternalMethodType::Get);
                     if (array->methodTable()->getOwnPropertySlotByIndex(array, m_exec, index, slot))
                         inValue = slot.getValue(m_exec, index);
                     else
@@ -670,7 +670,7 @@
                     propertyStack.removeLast();
                     break;
                 }
-                PropertySlot slot(object);
+                PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
                 if (object->methodTable()->getOwnPropertySlot(object, m_exec, properties[index], slot))
                     inValue = slot.getValue(m_exec, properties[index]);
                 else

Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSObject.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -264,7 +264,7 @@
 {
     String prototypeFunctionName;
     ExecState* exec = object->globalObject()->globalExec();
-    PropertySlot slot(object->structure()->storedPrototype());
+    PropertySlot slot(object->structure()->storedPrototype(), PropertySlot::InternalMethodType::VMInquiry);
     PropertyName constructor(exec->propertyNames().constructor);
     if (object->getPropertySlot(exec, constructor, slot)) {
         if (slot.isValue()) {
@@ -1270,15 +1270,17 @@
     structure->setHasGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
 }
 
+// HasProperty(O, P) from Section 7.3.10 of the spec.
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasproperty
 bool JSObject::hasProperty(ExecState* exec, PropertyName propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::HasProperty);
     return const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot);
 }
 
 bool JSObject::hasProperty(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::HasProperty);
     return const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot);
 }
 
@@ -1304,15 +1306,17 @@
     return true;
 }
 
+// HasOwnProperty(O, P) from section 7.3.11 in the spec.
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasownproperty
 bool JSObject::hasOwnProperty(ExecState* exec, PropertyName propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     return const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
 }
 
 bool JSObject::hasOwnProperty(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     return const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlotByIndex(const_cast<JSObject*>(this), exec, propertyName, slot);
 }
 
@@ -2548,7 +2552,7 @@
 
 bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
-    JSC::PropertySlot slot(this);
+    JSC::PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     if (!methodTable(exec->vm())->getOwnPropertySlot(this, exec, propertyName, slot))
         return false;
 

Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSObject.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -266,7 +266,7 @@
     {
         if (JSValue result = tryGetIndexQuickly(i))
             return result;
-        PropertySlot slot(this);
+        PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
         if (methodTable(exec->vm())->getOwnPropertySlotByIndex(this, exec, i, slot))
             return slot.getValue(exec, i);
         return JSValue();
@@ -1190,7 +1190,7 @@
 
 inline JSValue JSObject::get(ExecState* exec, PropertyName propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
         return slot.getValue(exec, propertyName);
     
@@ -1199,7 +1199,7 @@
 
 inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
         return slot.getValue(exec, propertyName);
 

Modified: trunk/Source/_javascript_Core/runtime/JSScope.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/JSScope.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/JSScope.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -127,7 +127,7 @@
             return true;
         }
 
-        PropertySlot slot(globalObject);
+        PropertySlot slot(globalObject, PropertySlot::InternalMethodType::VMInquiry);
         bool hasOwnProperty = globalObject->getOwnPropertySlot(globalObject, exec, ident, slot);
         if (!hasOwnProperty) {
             op = ResolveOp(makeType(UnresolvedProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);

Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -331,14 +331,14 @@
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot(description);
+    PropertySlot enumerableSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot(description);
+    PropertySlot configurableSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -346,21 +346,21 @@
     }
 
     JSValue value;
-    PropertySlot valueSlot(description);
+    PropertySlot valueSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot(description);
+    PropertySlot writableSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot(description);
+    PropertySlot getSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -375,7 +375,7 @@
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot(description);
+    PropertySlot setSlot(description, PropertySlot::InternalMethodType::HasProperty);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())

Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -174,7 +174,7 @@
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
-    PropertySlot slot(thisObject);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
     if (thisObject->getPropertySlot(exec, propertyName, slot)) {
         if (slot.isAccessor()) {
             GetterSetter* getterSetter = slot.getterSetter();
@@ -201,7 +201,7 @@
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
-    PropertySlot slot(thisObject);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
     if (thisObject->getPropertySlot(exec, propertyName, slot)) {
         if (slot.isAccessor()) {
             GetterSetter* getterSetter = slot.getterSetter();
@@ -264,7 +264,7 @@
     JSString* result = thisObject->structure(vm)->objectToStringValue();
     if (!result) {
         PropertyName toStringTagSymbol = exec->propertyNames().toStringTagSymbol;
-        PropertySlot toStringTagSlot(thisObject);
+        PropertySlot toStringTagSlot(thisObject, PropertySlot::InternalMethodType::Get);
         if (thisObject->getPropertySlot(exec, toStringTagSymbol, toStringTagSlot)) {
             JSValue stringTag = toStringTagSlot.getValue(exec, toStringTagSymbol);
             if (stringTag.isString()) {

Modified: trunk/Source/_javascript_Core/runtime/PropertySlot.h (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/PropertySlot.h	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/PropertySlot.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -59,26 +59,34 @@
 }
 
 class PropertySlot {
-    enum PropertyType {
+    enum PropertyType : uint8_t {
         TypeUnset,
         TypeValue,
         TypeGetter,
         TypeCustom
     };
 
-    enum CacheabilityType {
+    enum CacheabilityType : uint8_t {
         CachingDisallowed,
         CachingAllowed
     };
 
 public:
-    explicit PropertySlot(const JSValue thisValue)
-        : m_propertyType(TypeUnset)
-        , m_offset(invalidOffset)
+    enum class InternalMethodType : uint8_t {
+        Get, // [[Get]] internal method in the spec.
+        HasProperty, // [[HasProperty]] internal method in the spec.
+        GetOwnProperty, // [[GetOwnProperty]] internal method in the spec.
+        VMInquiry, // Our VM is just poking around. When this is the InternalMethodType, getOwnPropertySlot is not allowed to do user observable actions.
+    };
+
+    explicit PropertySlot(const JSValue thisValue, InternalMethodType internalMethodType)
+        : m_offset(invalidOffset)
         , m_thisValue(thisValue)
         , m_slotBase(nullptr)
         , m_watchpointSet(nullptr)
         , m_cacheability(CachingAllowed)
+        , m_propertyType(TypeUnset)
+        , m_internalMethodType(internalMethodType)
     {
     }
 
@@ -96,6 +104,8 @@
     bool isCacheableGetter() const { return isCacheable() && isAccessor(); }
     bool isCacheableCustom() const { return isCacheable() && isCustom(); }
 
+    InternalMethodType internalMethodType() const { return m_internalMethodType; }
+
     void disableCaching()
     {
         m_cacheability = CachingDisallowed;
@@ -262,12 +272,13 @@
         } custom;
     } m_data;
 
-    PropertyType m_propertyType;
     PropertyOffset m_offset;
     JSValue m_thisValue;
     JSObject* m_slotBase;
     WatchpointSet* m_watchpointSet;
     CacheabilityType m_cacheability;
+    PropertyType m_propertyType;
+    InternalMethodType m_internalMethodType;
 };
 
 ALWAYS_INLINE JSValue PropertySlot::getValue(ExecState* exec, PropertyName propertyName) const

Added: trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp (0 => 196722)


--- trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyConstructor.h"
+
+#include "Error.h"
+#include "JSCJSValueInlines.h"
+#include "JSCellInlines.h"
+#include "ObjectPrototype.h"
+#include "ProxyObject.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyConstructor);
+
+const ClassInfo ProxyConstructor::s_info = { "Proxy", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyConstructor) };
+
+ProxyConstructor* ProxyConstructor::create(VM& vm, Structure* structure)
+{
+    ProxyConstructor* constructor = new (NotNull, allocateCell<ProxyConstructor>(vm.heap)) ProxyConstructor(vm, structure);
+    constructor->finishCreation(vm, "Proxy");
+    return constructor;
+}
+
+ProxyConstructor::ProxyConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void ProxyConstructor::finishCreation(VM& vm, const char* name)
+{
+    Base::finishCreation(vm, name);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructProxyObject(ExecState* exec)
+{
+    if (exec->newTarget().isUndefined())
+        return throwVMTypeError(exec, ASCIILiteral("new.target of Proxy construct should not be undefined."));
+
+    ArgList args(exec);
+    JSValue target = args.at(0);
+    JSValue handler = args.at(1);
+    return JSValue::encode(ProxyObject::create(exec, exec->lexicalGlobalObject()->proxyObjectStructure(), target, handler));
+}
+
+ConstructType ProxyConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructProxyObject;
+    return ConstructTypeHost;
+}
+
+CallType ProxyConstructor::getCallData(JSCell*, CallData& callData)
+{
+    // Proxy should throw a TypeError when called as a function.
+    callData.js.functionExecutable = 0;
+    callData.js.scope = 0;
+    callData.native.function = 0;
+    return CallTypeNone;
+}
+
+} // namespace JSC

Added: trunk/Source/_javascript_Core/runtime/ProxyConstructor.h (0 => 196722)


--- trunk/Source/_javascript_Core/runtime/ProxyConstructor.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ProxyConstructor.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ProxyConstructor_h
+#define ProxyConstructor_h
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class ProxyConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static ProxyConstructor* create(VM&, Structure*);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    void finishCreation(VM&, const char* name);
+
+private:
+    ProxyConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    static EncodedJSValue getGetter(ExecState*, EncodedJSValue thisValue, PropertyName);
+};
+
+} // namespace JSC
+
+#endif // ProxyConstructor_h

Added: trunk/Source/_javascript_Core/runtime/ProxyObject.cpp (0 => 196722)


--- trunk/Source/_javascript_Core/runtime/ProxyObject.cpp	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ProxyObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyObject.h"
+
+#include "Error.h"
+#include "JSCJSValueInlines.h"
+#include "JSCellInlines.h"
+#include "SlotVisitorInlines.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyObject);
+
+const ClassInfo ProxyObject::s_info = { "ProxyObject", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyObject) };
+
+ProxyObject::ProxyObject(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void ProxyObject::finishCreation(VM& vm, ExecState* exec, JSValue target, JSValue handler)
+{
+    Base::finishCreation(vm);
+    if (!target.isObject()) {
+        throwTypeError(exec, ASCIILiteral("A Proxy's 'target' should be an Object"));
+        return;
+    }
+    if (ProxyObject* targetAsProxy = jsDynamicCast<ProxyObject*>(target)) {
+        // FIXME: Add tests for this once we implement Proxy.revoke(.).
+        // https://bugs.webkit.org/show_bug.cgi?id=154321
+        if (targetAsProxy->handler().isNull()) {
+            throwTypeError(exec, ASCIILiteral("If a Proxy's handler is another Proxy object, the other Proxy object must have a non-null handler."));
+            return;
+        }
+    }
+    if (!handler.isObject()) {
+        throwTypeError(exec, ASCIILiteral("A Proxy's 'handler' should be an Object"));
+        return;
+    }
+
+    m_target.set(vm, this, jsCast<JSObject*>(target));
+    m_handler.set(vm, this, handler);
+}
+
+static EncodedJSValue performProxyGet(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    JSObject* thisObject = jsCast<JSObject*>(JSValue::decode(thisValue)); // This might be a value where somewhere in __proto__ chain lives a ProxyObject.
+    JSObject* proxyObjectAsObject = thisObject;
+    // FIXME: make it so that custom getters take both the |this| value and the slotBase (property holder).
+    // https://bugs.webkit.org/show_bug.cgi?id=154320
+    while (true) {
+        if (LIKELY(proxyObjectAsObject->inherits(ProxyObject::info())))
+            break;
+
+        Structure& structure = *vm.heap.structureIDTable().get(proxyObjectAsObject->structureID());
+        JSValue prototype = structure.storedPrototype();
+        RELEASE_ASSERT(prototype.isObject());
+        proxyObjectAsObject = asObject(prototype);
+    }
+
+    ProxyObject* proxyObject = jsCast<ProxyObject*>(proxyObjectAsObject);
+    JSValue handlerValue = proxyObject->handler();
+    if (handlerValue.isNull())
+        return throwVMTypeError(exec, ASCIILiteral("Proxy 'handler' is null. It should be an Object."));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    JSObject* target = proxyObject->target();
+    JSValue getHandler = handler->get(exec, vm.propertyNames->get);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    if (getHandler.isUndefined())
+        return JSValue::encode(target->get(exec, propertyName));
+
+    if (!getHandler.isCell())
+        return throwVMTypeError(exec, ASCIILiteral("'get' property of Proxy's handler should be callable."));
+
+    CallData callData;
+    CallType callType = getHandler.asCell()->methodTable()->getCallData(getHandler.asCell(), callData);
+    if (callType == CallTypeNone)
+        return throwVMTypeError(exec, ASCIILiteral("'get' property of Proxy's handler should be callable."));
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(jsString(exec, propertyName.uid()));
+    arguments.append(thisObject);
+    JSValue trapResult = call(exec, getHandler, callType, callData, handler, arguments);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), trapResult))
+                return throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property."));
+        } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.getter().isUndefined()) {
+            if (!trapResult.isUndefined())
+                return throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined."));
+        }
+    }
+
+    // FIXME: when implementing Proxy.[[GetOwnProperty]] it would be a good test to
+    // have handler be another Proxy where its handler throws on [[GetOwnProperty]]
+    // right here.
+    // https://bugs.webkit.org/show_bug.cgi?id=154314
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    return JSValue::encode(trapResult);
+}
+
+bool ProxyObject::getOwnPropertySlotCommon(ExecState*, PropertySlot& slot)
+{
+    if (slot.internalMethodType() == PropertySlot::InternalMethodType::Get) {
+        slot.setCustom(this, CustomAccessor, performProxyGet);
+        slot.disableCaching();
+        return true;
+    }
+
+    // FIXME: Implement Proxy.[[HasProperty]] and Proxy.[[GetOwnProperty]]
+    // https://bugs.webkit.org/show_bug.cgi?id=154313
+    // https://bugs.webkit.org/show_bug.cgi?id=154314
+    return false;
+}
+bool ProxyObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->getOwnPropertySlotCommon(exec, slot);
+}
+
+bool ProxyObject::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->getOwnPropertySlotCommon(exec, slot);
+}
+
+void ProxyObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(&thisObject->m_target);
+    visitor.append(&thisObject->m_handler);
+}
+
+} // namespace JSC

Added: trunk/Source/_javascript_Core/runtime/ProxyObject.h (0 => 196722)


--- trunk/Source/_javascript_Core/runtime/ProxyObject.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ProxyObject.h	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ProxyObject_h
+#define ProxyObject_h
+
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class ProxyObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+
+    static ProxyObject* create(ExecState* exec, Structure* structure, JSValue target, JSValue handler)
+    {
+        VM& vm = exec->vm();
+        ProxyObject* proxy = new (NotNull, allocateCell<ProxyObject>(vm.heap)) ProxyObject(vm, structure);
+        proxy->finishCreation(vm, exec, target, handler);
+        return proxy;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JSObject* target() { return m_target.get(); }
+    JSValue handler() { return m_handler.get(); }
+
+private:
+    ProxyObject(VM&, Structure*);
+    void finishCreation(VM&, ExecState*, JSValue target, JSValue handler);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    bool getOwnPropertySlotCommon(ExecState*, PropertySlot&);
+
+    WriteBarrier<JSObject> m_target;
+    WriteBarrier<Unknown> m_handler;
+};
+
+} // namespace JSC
+
+#endif // JSPromise_h

Modified: trunk/Source/_javascript_Core/runtime/ReflectObject.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/ReflectObject.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/ReflectObject.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -135,7 +135,7 @@
     if (exec->argumentCount() >= 3)
         receiver = exec->argument(2);
 
-    PropertySlot slot(receiver);
+    PropertySlot slot(receiver, PropertySlot::InternalMethodType::Get);
     return JSValue::encode(target.get(exec, propertyName, slot));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -581,7 +581,7 @@
 
     ExecState* exec = callee->globalObject()->globalExec();
     auto getPropertyIfPureOperation = [&] (const Identifier& ident) -> String {
-        PropertySlot slot(callee);
+        PropertySlot slot(callee, PropertySlot::InternalMethodType::VMInquiry);
         PropertyName propertyName(ident);
         if (callee->getPropertySlot(exec, propertyName, slot)) {
             if (slot.isValue()) {

Modified: trunk/Source/_javascript_Core/tests/es6.yaml (196721 => 196722)


--- trunk/Source/_javascript_Core/tests/es6.yaml	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/tests/es6.yaml	2016-02-17 22:11:39 UTC (rev 196722)
@@ -913,7 +913,7 @@
 - path: es6/Proxy_construct_handler.js
   cmd: runES6 :fail
 - path: es6/Proxy_constructor_requires_new.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_defineProperty_handler.js
   cmd: runES6 :fail
 - path: es6/Proxy_deleteProperty_handler.js
@@ -921,9 +921,9 @@
 - path: es6/Proxy_enumerate_handler.js
   cmd: runES6 :fail
 - path: es6/Proxy_get_handler.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_get_handler_instances_of_proxies.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_getOwnPropertyDescriptor_handler.js
   cmd: runES6 :fail
 - path: es6/Proxy_getPrototypeOf_handler.js
@@ -953,27 +953,27 @@
 - path: es6/Proxy_internal_get_calls_Array.prototype.concat.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Array.prototype.pop.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_Array.prototype.reverse.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Array.prototype.shift.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_Array.prototype.splice.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Array.prototype.toString.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_Array.prototype_iteration_methods.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_ClassDefinitionEvaluation.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_CreateDynamicFunction.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_CreateListFromArrayLike.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_Date.prototype.toJSON.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Error.prototype.toString.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_Function.prototype.bind.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_HasBinding.js
@@ -981,7 +981,7 @@
 - path: es6/Proxy_internal_get_calls_instanceof_operator.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_IteratorComplete_IteratorValue.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_JSON.stringify.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Object.assign.js
@@ -989,7 +989,7 @@
 - path: es6/Proxy_internal_get_calls_Object.defineProperties.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_Promise_resolve_functions.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_RegExp.prototype.flags.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_RegExp.prototype.test.js
@@ -1013,7 +1013,7 @@
 - path: es6/Proxy_internal_get_calls_String.prototype.split.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_String.raw.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_ToPrimitive.js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_ToPropertyDescriptor.js
@@ -1221,4 +1221,4 @@
 - path: es6/Object_static_methods_Object.getOwnPropertyDescriptors.js
   cmd: runES6 :normal
 - path: es6/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js
-  cmd: runES6 :fail
\ No newline at end of file
+  cmd: runES6 :fail

Added: trunk/Source/_javascript_Core/tests/stress/proxy-basic.js (0 => 196722)


--- trunk/Source/_javascript_Core/tests/stress/proxy-basic.js	                        (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/proxy-basic.js	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,187 @@
+function assert(b) {
+    if (!b)
+        throw new Error("Bad assertion");
+}
+
+assert(Proxy instanceof Function);
+assert(Proxy.length === 2);
+assert(Proxy.prototype === undefined);
+
+{
+    for (let i = 0; i < 1000; i++)
+        assert((new Proxy({}, {})).__proto__ === Object.prototype);
+}
+
+{
+    // When we call Proxy it should throw
+    for (let i = 0; i < 100; i++) {
+        let threw = false;
+        try {
+            Proxy({}, {});
+        } catch(e) {
+            threw = true;
+            assert(e.toString() === "TypeError: Proxy is not a function. (In 'Proxy({}, {})', 'Proxy' is an instance of Function)");
+        }
+        assert(threw === true);
+    }
+
+    let theTarget = {
+        x: 30
+    };
+
+    let handler = {
+        get: function(target, propName, proxyArg) {
+            assert(target === theTarget);
+            assert(proxyArg === proxy);
+            if (propName === "y")
+                return 45;
+            assert(propName === "x");
+            return target[propName];
+        }
+    };
+
+    let proxy = new Proxy(theTarget, handler);
+    for (let i = 0; i < 1000; i++) {
+        assert(proxy.x === 30);
+        assert(proxy.y === 45);
+        assert(proxy["x"] === 30);
+        assert(proxy["y"] === 45);
+    }
+
+}
+
+{
+    let handler = {get: null};
+    let target = {x: 20};
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i < 500; i++) {
+        let threw = false;
+        try {
+            if (i % 2)
+                proxy.foo;
+            else
+                proxy["foo"];
+        } catch(e) {
+            threw = true;
+            assert(e.toString() === "TypeError: 'get' property of Proxy's handler should be callable.");
+        }
+        assert(threw);
+    }
+}
+
+{
+    let handler = {get: {}};
+    let target = {x: 20};
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i < 500; i++) {
+        let threw = false;
+        try {
+            if (i % 2)
+                proxy.foo;
+            else
+                proxy["foo"];
+        } catch(e) {
+            threw = true;
+            assert(e.toString() === "TypeError: 'get' property of Proxy's handler should be callable.");
+        }
+        assert(threw);
+    }
+}
+
+{
+    let handler = {};
+    let target = {x: 20};
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i < 500; i++) {
+        assert(proxy.x === 20);
+        assert(proxy.y === undefined);
+    }
+}
+
+{
+    let handler = {};
+    let target = [1, 2, 3];
+    let proxy = new Proxy(target, handler);
+    for (let i = 0; i < 500; i++) {
+        assert(proxy[0] === 1);
+        assert(proxy[1] === 2);
+        assert(proxy[2] === 3);
+    }
+}
+
+{
+    let theTarget = [1, 2, 3];
+    let handler = {
+        get: function(target, propName, proxyArg) {
+            switch (propName) {
+            case "0":
+            case "1":
+                return 100;
+            case "2":
+            case "length":
+                return target[propName];
+            }
+            assert(false);
+        }
+    };
+    let proxy = new Proxy(theTarget, handler);
+    for (let i = 0; i < 500; i++) {
+        assert(proxy[0] === 100);
+        assert(proxy[1] === 100);
+        assert(proxy[2] === 3);
+        assert(proxy.length === 3);
+        assert(proxy["length"] === 3);
+    }
+}
+
+{
+    let wasCalled = false;
+    let theTarget = {
+        get x() {
+            wasCalled = true;
+            return 25;
+        }
+    };
+    let j = 0;
+    let handler = {
+        get: function(target, propName, proxyArg) {
+            assert(target === theTarget);
+            let x = j++;
+            if (x % 2)
+                return target[propName];
+            else
+                return "hello";
+        }
+    };
+
+    let proxy = new Proxy(theTarget, handler);
+    for (let i = 0; i < 500; i++) {
+        if (i % 2)
+            assert(proxy.x === 25);
+        else
+            assert(proxy.x === "hello");
+            
+    }
+
+    assert(wasCalled);
+}
+
+{
+    let theTarget = {
+        x: 40
+    };
+    let handler = {
+        get: function(target, propName, proxyArg) {
+            return 30;
+        }
+    };
+
+    let proxy = new Proxy(theTarget, handler);
+    for (let i = 0; i < 500; i++) {
+        assert(proxy.x === 30);
+    }
+    handler.get = undefined;
+    for (let i = 0; i < 500; i++) {
+        assert(proxy.x === 40);
+    }
+}

Added: trunk/Source/_javascript_Core/tests/stress/proxy-in-proto-chain.js (0 => 196722)


--- trunk/Source/_javascript_Core/tests/stress/proxy-in-proto-chain.js	                        (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/proxy-in-proto-chain.js	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,28 @@
+function assert(b) {
+    if (!b)
+        throw new Error("Bad assertion");
+}
+
+let theTarget = {
+    x: 30
+};
+
+let handler = {
+    get: function(target, propName, proxyArg) {
+        assert(target === theTarget);
+        assert(proxyArg === obj);
+        if (propName === "y")
+            return 45;
+        assert(propName === "x");
+        return target[propName];
+    }
+};
+
+let proxy = new Proxy(theTarget, handler);
+
+let obj = Object.create(proxy);
+
+for (let i = 0; i < 1000; i++) {
+    assert(obj.x === 30);
+    assert(obj.y === 45);
+}

Added: trunk/Source/_javascript_Core/tests/stress/proxy-of-a-proxy.js (0 => 196722)


--- trunk/Source/_javascript_Core/tests/stress/proxy-of-a-proxy.js	                        (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/proxy-of-a-proxy.js	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,34 @@
+function assert(b) {
+    if (!b)
+        throw new Error("Bad assertion");
+}
+
+{
+    let ogTarget = {x: 20};
+    let theTarget = new Proxy(ogTarget, {
+        get: function(target, propName, proxyArg) {
+            assert(target === ogTarget);
+            if (propName === "y")
+                return 45;
+            return target[propName];
+        }
+    });
+    let handler = {
+        get: function(target, propName, proxyArg) {
+            if (propName === "z")
+                return 60;
+            return target[propName];
+        }
+    };
+    let proxy = new Proxy(theTarget, handler);
+    for (let i = 0; i < 500; i++) {
+        assert(proxy.x === 20);
+        assert(proxy["x"] === 20);
+
+        assert(proxy.y === 45);
+        assert(proxy["y"] === 45);
+
+        assert(proxy.z === 60);
+        assert(proxy["z"] === 60);
+    }
+}

Added: trunk/Source/_javascript_Core/tests/stress/proxy-property-descriptor.js (0 => 196722)


--- trunk/Source/_javascript_Core/tests/stress/proxy-property-descriptor.js	                        (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/proxy-property-descriptor.js	2016-02-17 22:11:39 UTC (rev 196722)
@@ -0,0 +1,83 @@
+function assert(b) {
+    if (!b)
+        throw new Error("Bad assertion");
+}
+
+let theTarget = {};
+Object.defineProperty(theTarget, "x", {
+    writable: false,
+    configurable: false,
+    value: 45
+});
+
+Object.defineProperty(theTarget, "y", {
+    writable: false,
+    configurable: false,
+    value: 45
+});
+
+Object.defineProperty(theTarget, "getter", {
+    configurable: false,
+    set: function(x) { }
+});
+
+Object.defineProperty(theTarget, "badGetter", {
+    configurable: false,
+    set: function(x) { }
+});
+
+let handler = {
+    get: function(target, propName, proxyArg) {
+        assert(target === theTarget);
+        assert(proxyArg === proxy);
+        if (propName === "x")
+            return 45;
+        else if (propName === "y")
+            return 30;
+        else if (propName === "getter")
+            return undefined;
+        else {
+            assert(propName === "badGetter");
+            return 25;
+        }
+    }
+};
+
+let proxy = new Proxy(theTarget, handler);
+
+for (let i = 0; i < 1000; i++) {
+    assert(proxy.x === 45);
+    assert(proxy["x"] === 45);
+}
+
+for (let i = 0; i < 1000; i++) {
+    try {
+        if (i % 2)
+            proxy.y;
+        else
+            proxy["y"];
+    } catch(e) {
+        threw = true;
+        assert(e.toString() === "TypeError: Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property.");
+    }
+    assert(threw === true);
+}
+
+for (let i = 0; i < 1000; i++) {
+    assert(proxy.getter === undefined);
+    assert(proxy["getter"] === undefined);
+}
+
+for (let i = 0; i < 1000; i++) {
+    try {
+        if (i % 2)
+            proxy.badGetter;
+        else
+            proxy["badGetter"];
+
+    } catch(e) {
+        threw = true;
+        assert(e.toString() === "TypeError: Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined.");
+    }
+    assert(threw === true);
+}

Modified: trunk/Source/_javascript_Core/wasm/WASMModuleParser.cpp (196721 => 196722)


--- trunk/Source/_javascript_Core/wasm/WASMModuleParser.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/_javascript_Core/wasm/WASMModuleParser.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -358,7 +358,7 @@
 {
     FAIL_IF_FALSE(m_imports, "Accessing property of non-object.");
     Identifier identifier = Identifier::fromString(&m_vm, importName);
-    PropertySlot slot(m_imports.get());
+    PropertySlot slot(m_imports.get(), PropertySlot::InternalMethodType::Get);
     if (!m_imports->getPropertySlot(exec, identifier, slot))
         FAIL_WITH_MESSAGE("Can't find a property named \"" + importName + '"');
     FAIL_IF_FALSE(slot.isValue(), "\"" + importName + "\" is not a data property.");

Modified: trunk/Source/WebCore/ChangeLog (196721 => 196722)


--- trunk/Source/WebCore/ChangeLog	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/ChangeLog	2016-02-17 22:11:39 UTC (rev 196722)
@@ -1,3 +1,32 @@
+2016-02-17  Saam barati  <[email protected]>
+
+        Implement Proxy [[Get]]
+        https://bugs.webkit.org/show_bug.cgi?id=154081
+
+        Reviewed by Michael Saboff.
+
+        Tests are in _javascript_Core.
+
+        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
+        (WebCore::getProperty):
+        (WebCore::getHashAlgorithm):
+        * bindings/js/JSCryptoKeySerializationJWK.cpp:
+        (WebCore::getJSArrayFromJSON):
+        (WebCore::getStringFromJSON):
+        (WebCore::getBooleanFromJSON):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::DialogHandler::returnValue):
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::tryGetProperty):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::deletePropertyByIndex):
+        (WebCore::JSStorage::putDelegate):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::getProperty):
+        * testing/Internals.cpp:
+        (WebCore::Internals::isReadableStreamDisturbed):
+
 2016-02-17  Simon Fraser  <[email protected]>
 
         PDFPlugin's scrollableArea container is not properly unregistered when page is going into the PageCache

Modified: trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -95,7 +95,7 @@
 static JSValue getProperty(ExecState* exec, JSObject* object, const char* name)
 {
     Identifier identifier = Identifier::fromString(exec, name);
-    PropertySlot slot(object);
+    PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
 
     if (object->getPropertySlot(exec, identifier, slot))
         return slot.getValue(exec, identifier);
@@ -111,7 +111,6 @@
     JSObject* object = dictionary.initializerObject();
 
     Identifier identifier = Identifier::fromString(exec, "hash");
-    PropertySlot slot(object);
 
     JSValue hash = getProperty(exec, object, "hash");
     if (exec->hadException())

Modified: trunk/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -53,7 +53,7 @@
 static bool getJSArrayFromJSON(ExecState* exec, JSObject* json, const char* key, JSArray*& result)
 {
     Identifier identifier = Identifier::fromString(exec, key);
-    PropertySlot slot(json);
+    PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
 
     if (!json->getPropertySlot(exec, identifier, slot))
         return false;
@@ -73,7 +73,7 @@
 static bool getStringFromJSON(ExecState* exec, JSObject* json, const char* key, String& result)
 {
     Identifier identifier = Identifier::fromString(exec, key);
-    PropertySlot slot(json);
+    PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
 
     if (!json->getPropertySlot(exec, identifier, slot))
         return false;
@@ -94,7 +94,7 @@
 static bool getBooleanFromJSON(ExecState* exec, JSObject* json, const char* key, bool& result)
 {
     Identifier identifier = Identifier::fromString(exec, key);
-    PropertySlot slot(json);
+    PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
 
     if (!json->getPropertySlot(exec, identifier, slot))
         return false;

Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -548,7 +548,7 @@
     if (!globalObject)
         return jsUndefined();
     Identifier identifier = Identifier::fromString(&m_exec, "returnValue");
-    PropertySlot slot(globalObject);
+    PropertySlot slot(globalObject, PropertySlot::InternalMethodType::Get);
     if (!JSGlobalObject::getOwnPropertySlot(globalObject, &m_exec, identifier, slot))
         return jsUndefined();
     return slot.getValue(&m_exec, identifier);

Modified: trunk/Source/WebCore/bindings/js/JSDictionary.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/JSDictionary.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/JSDictionary.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -70,7 +70,7 @@
 {
     ASSERT(isValid());
     Identifier identifier = Identifier::fromString(m_exec, propertyName);
-    PropertySlot slot(m_initializerObject.get());
+    PropertySlot slot(m_initializerObject.get(), PropertySlot::InternalMethodType::Get);
 
     if (!m_initializerObject.get()->getPropertySlot(m_exec, identifier, slot))
         return NoPropertyFound;

Modified: trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -57,7 +57,7 @@
     // Only perform the custom delete if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
     // the native property slots manually.
-    PropertySlot slot(thisObject);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
 
     static_assert(!hasStaticPropertyTable, "This function does not handle static instance properties");
 
@@ -76,8 +76,6 @@
 
 bool JSStorage::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
 {
-    JSStorage* thisObject = jsCast<JSStorage*>(cell);
-    PropertySlot slot(thisObject);
     static_assert(!hasStaticPropertyTable, "This function does not handle static instance properties");
     return deleteProperty(cell, exec, Identifier::from(exec, propertyName));
 }
@@ -105,7 +103,7 @@
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
     // the native property slots manually.
-    PropertySlot slot(this);
+    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     static_assert(!hasStaticPropertyTable, "This function does not handle static instance properties");
 
     JSValue prototype = this->prototype();

Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (196721 => 196722)


--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -641,7 +641,7 @@
 
     JSValue getProperty(JSObject* object, const Identifier& propertyName)
     {
-        PropertySlot slot(object);
+        PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
         if (object->methodTable()->getOwnPropertySlot(object, m_exec, propertyName, slot))
             return slot.getValue(m_exec, propertyName);
         return JSValue();

Modified: trunk/Source/WebCore/testing/Internals.cpp (196721 => 196722)


--- trunk/Source/WebCore/testing/Internals.cpp	2016-02-17 22:03:56 UTC (rev 196721)
+++ trunk/Source/WebCore/testing/Internals.cpp	2016-02-17 22:11:39 UTC (rev 196722)
@@ -3459,7 +3459,7 @@
     JSVMClientData* clientData = static_cast<JSVMClientData*>(state.vm().clientData);
     const Identifier& privateName = clientData->builtinFunctions().readableStreamInternalsBuiltins().isReadableStreamDisturbedPrivateName();
     JSValue value;
-    PropertySlot propertySlot(value);
+    PropertySlot propertySlot(value, PropertySlot::InternalMethodType::Get);
     globalObject->fastGetOwnPropertySlot(&state, state.vm(), *globalObject->structure(), privateName, propertySlot);
     value = propertySlot.getValue(&state, privateName);
     ASSERT(value.isFunction());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to