webkitgtk-2.16.5HEADwebkitgtk-2.16.5master

1 files changed, 1164 insertions, 0 deletions

diff --git a/Source/JavaScriptCore/runtime/ProxyObject.cpp b/Source/JavaScriptCore/runtime/ProxyObject.cpp
new file mode 100644
index 000000000..a9b64ea76
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ProxyObject.cpp
@@ -0,0 +1,1164 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyObject.h"
+
+#include "ArrayConstructor.h"
+#include "Error.h"
+#include "IdentifierInlines.h"
+#include "JSCInlines.h"
+#include "JSObjectInlines.h"
+#include "ObjectConstructor.h"
+#include "SlotVisitorInlines.h"
+#include "StructureInlines.h"
+#include "VMInlines.h"
+
+// Note that this file is compile with -fno-optimize-sibling-calls because we rely on the machine stack
+// growing larger for throwing OOM errors for when we have an effectively cyclic prototype chain.
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyObject);
+
+const ClassInfo ProxyObject::s_info = { "ProxyObject", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyObject) };
+
+ProxyObject::ProxyObject(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+String ProxyObject::toStringName(const JSObject* object, ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    const ProxyObject* proxy = jsCast<const ProxyObject*>(object);
+    while (proxy) {
+        const JSObject* target = proxy->target();
+        if (isArray(exec, target))
+            return target->classInfo(vm)->methodTable.toStringName(target, exec);
+        if (UNLIKELY(scope.exception()))
+            break;
+
+        proxy = jsDynamicCast<const ProxyObject*>(vm, target);
+    }
+    return ASCIILiteral("Object");
+}
+
+Structure* ProxyObject::structureForTarget(JSGlobalObject* globalObject, JSValue target)
+{
+    if (!target.isObject())
+        return globalObject->proxyObjectStructure();
+
+    JSObject* targetAsObject = jsCast<JSObject*>(target);
+    CallData ignoredCallData;
+    VM& vm = globalObject->vm();
+    bool isCallable = targetAsObject->methodTable(vm)->getCallData(targetAsObject, ignoredCallData) != CallType::None;
+    return isCallable ? globalObject->callableProxyObjectStructure() : globalObject->proxyObjectStructure();
+}
+
+void ProxyObject::finishCreation(VM& vm, ExecState* exec, JSValue target, JSValue handler)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Base::finishCreation(vm);
+    if (!target.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'target' should be an Object"));
+        return;
+    }
+    if (ProxyObject* targetAsProxy = jsDynamicCast<ProxyObject*>(vm, target)) {
+        if (targetAsProxy->handler().isNull()) {
+            throwTypeError(exec, scope, ASCIILiteral("If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked"));
+            return;
+        }
+    }
+    if (!handler.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'handler' should be an Object"));
+        return;
+    }
+
+    JSObject* targetAsObject = jsCast<JSObject*>(target);
+
+    CallData ignoredCallData;
+    m_isCallable = targetAsObject->methodTable(vm)->getCallData(targetAsObject, ignoredCallData) != CallType::None;
+    if (m_isCallable) {
+        TypeInfo info = structure(vm)->typeInfo();
+        RELEASE_ASSERT(info.implementsHasInstance() && info.implementsDefaultHasInstance());
+    }
+
+    ConstructData ignoredConstructData;
+    m_isConstructible = jsCast<JSObject*>(target)->methodTable(vm)->getConstructData(jsCast<JSObject*>(target), ignoredConstructData) != ConstructType::None;
+
+    m_target.set(vm, this, targetAsObject);
+    m_handler.set(vm, this, handler);
+}
+
+static const char* s_proxyAlreadyRevokedErrorMessage = "Proxy has already been revoked. No more operations are allowed to be performed on it";
+
+static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValue receiver, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return { };
+    }
+
+    JSObject* target = proxyObject->target();
+
+    auto performDefaultGet = [&] {
+        return target->get(exec, propertyName);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultGet();
+    }
+
+    JSValue handlerValue = proxyObject->handler();
+    if (handlerValue.isNull())
+        return throwTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getHandler = handler->getMethod(exec, callData, callType, vm.propertyNames->get, ASCIILiteral("'get' property of a Proxy's handler object should be callable"));
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (getHandler.isUndefined()) {
+        scope.release();
+        return performDefaultGet();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(receiver);
+    JSValue trapResult = call(exec, getHandler, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), trapResult))
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"));
+        } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.getter().isUndefined()) {
+            if (!trapResult.isUndefined())
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined"));
+        }
+    }
+
+    RETURN_IF_EXCEPTION(scope, { });
+
+    return trapResult;
+}
+
+bool ProxyObject::performGet(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue result = performProxyGet(exec, this, slot.thisValue(), propertyName);
+    RETURN_IF_EXCEPTION(scope, false);
+    unsigned ignoredAttributes = 0;
+    slot.setValue(this, ignoredAttributes, result);
+    return true;
+}
+
+bool ProxyObject::performInternalMethodGetOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    JSObject* target = this->target();
+
+    auto performDefaultGetOwnProperty = [&] {
+        return target->methodTable(vm)->getOwnPropertySlot(target, exec, propertyName, slot);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultGetOwnProperty();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getOwnPropertyDescriptorMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "getOwnPropertyDescriptor"), ASCIILiteral("'getOwnPropertyDescriptor' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    if (getOwnPropertyDescriptorMethod.isUndefined()) {
+        scope.release();
+        return performDefaultGetOwnProperty();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, getOwnPropertyDescriptorMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResult.isUndefined() && !trapResult.isObject()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("result of 'getOwnPropertyDescriptor' call should either be an Object or undefined"));
+        return false;
+    }
+
+    PropertyDescriptor targetPropertyDescriptor;
+    bool isTargetPropertyDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, targetPropertyDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResult.isUndefined()) {
+        if (!isTargetPropertyDescriptorDefined)
+            return false;
+        if (!targetPropertyDescriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable"));
+            return false;
+        }
+        // FIXME: this doesn't work if 'target' is another Proxy. We don't have isExtensible implemented in a way that fits w/ Proxys.
+        // https://bugs.webkit.org/show_bug.cgi?id=154375
+        bool isExtensible = target->isExtensible(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (!isExtensible) {
+            // FIXME: Come up with a test for this error. I'm not sure how to because
+            // Object.seal(o) will make all fields [[Configurable]] false.
+            // https://bugs.webkit.org/show_bug.cgi?id=154376
+            throwVMTypeError(exec, scope, ASCIILiteral("When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible"));
+            return false;
+        }
+
+        return false;
+    }
+
+    bool isExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    PropertyDescriptor trapResultAsDescriptor;
+    toPropertyDescriptor(exec, trapResult, trapResultAsDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool throwException = false;
+    bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible,
+        trapResultAsDescriptor, isTargetPropertyDescriptorDefined, targetPropertyDescriptor, throwException);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!valid) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test"));
+        return false;
+    }
+
+    if (!trapResultAsDescriptor.configurable()) {
+        if (!isTargetPropertyDescriptorDefined || targetPropertyDescriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'"));
+            return false;
+        }
+    }
+
+    if (trapResultAsDescriptor.isAccessorDescriptor()) {
+        GetterSetter* getterSetter = trapResultAsDescriptor.slowGetterSetter(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        slot.setGetterSlot(this, trapResultAsDescriptor.attributes(), getterSetter);
+    } else if (trapResultAsDescriptor.isDataDescriptor() && !trapResultAsDescriptor.value().isEmpty())
+        slot.setValue(this, trapResultAsDescriptor.attributes(), trapResultAsDescriptor.value());
+    else
+        slot.setValue(this, trapResultAsDescriptor.attributes(), jsUndefined()); // We use undefined because it's the default value in object properties.
+
+    return true;
+}
+
+bool ProxyObject::performHasProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    JSObject* target = this->target();
+    slot.setValue(this, None, jsUndefined()); // Nobody should rely on our value, but be safe and protect against any bad actors reading our value.
+
+    auto performDefaultHasProperty = [&] {
+        return target->methodTable(vm)->getOwnPropertySlot(target, exec, propertyName, slot);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultHasProperty();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue hasMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->has, ASCIILiteral("'has' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    if (hasMethod.isUndefined()) {
+        scope.release();
+        return performDefaultHasProperty();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, hasMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool) {
+        PropertyDescriptor descriptor;
+        bool isPropertyDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); 
+        RETURN_IF_EXCEPTION(scope, false);
+        if (isPropertyDescriptorDefined) {
+            if (!descriptor.configurable()) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for non-configurable properties"));
+                return false;
+            }
+            bool isExtensible = target->isExtensible(exec);
+            RETURN_IF_EXCEPTION(scope, false);
+            if (!isExtensible) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property"));
+                return false;
+            }
+        }
+    }
+
+    return trapResultAsBool;
+}
+
+bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    slot.disableCaching();
+    slot.setIsTaintedByOpaqueObject();
+    switch (slot.internalMethodType()) {
+    case PropertySlot::InternalMethodType::Get:
+        scope.release();
+        return performGet(exec, propertyName, slot);
+    case PropertySlot::InternalMethodType::GetOwnProperty:
+        scope.release();
+        return performInternalMethodGetOwnProperty(exec, propertyName, slot);
+    case PropertySlot::InternalMethodType::HasProperty:
+        scope.release();
+        return performHasProperty(exec, propertyName, slot);
+    default:
+        return false;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool ProxyObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->getOwnPropertySlotCommon(exec, propertyName, slot);
+}
+
+bool ProxyObject::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    Identifier ident = Identifier::from(exec, propertyName); 
+    return thisObject->getOwnPropertySlotCommon(exec, ident.impl(), slot);
+}
+
+template <typename PerformDefaultPutFunction>
+bool ProxyObject::performPut(ExecState* exec, JSValue putValue, JSValue thisValue, PropertyName propertyName, PerformDefaultPutFunction performDefaultPut)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultPut();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue setMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->set, ASCIILiteral("'set' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (setMethod.isUndefined()) {
+        scope.release();
+        return performDefaultPut();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(putValue);
+    arguments.append(thisValue);
+    JSValue trapResult = call(exec, setMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), putValue)) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'"));
+                return false;
+            }
+        } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.setter().isUndefined()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false"));
+            return false;
+        }
+    }
+    return true;
+}
+
+bool ProxyObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    slot.disableCaching();
+
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    auto performDefaultPut = [&] () {
+        JSObject* target = jsCast<JSObject*>(thisObject->target());
+        return target->methodTable(vm)->put(target, exec, propertyName, value, slot);
+    };
+    return thisObject->performPut(exec, value, slot.thisValue(), propertyName, performDefaultPut);
+}
+
+bool ProxyObject::putByIndexCommon(ExecState* exec, JSValue thisValue, unsigned propertyName, JSValue putValue, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Identifier ident = Identifier::from(exec, propertyName);
+    RETURN_IF_EXCEPTION(scope, false);
+    auto performDefaultPut = [&] () {
+        JSObject* target = this->target();
+        bool isStrictMode = shouldThrow;
+        PutPropertySlot slot(thisValue, isStrictMode); // We must preserve the "this" target of the putByIndex.
+        return target->methodTable(vm)->put(target, exec, ident.impl(), putValue, slot);
+    };
+    scope.release();
+    return performPut(exec, putValue, thisValue, ident.impl(), performDefaultPut);
+}
+
+bool ProxyObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    return thisObject->putByIndexCommon(exec, thisObject, propertyName, value, shouldThrow);
+}
+
+static EncodedJSValue JSC_HOST_CALL performProxyCall(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return encodedJSValue();
+    }
+    ProxyObject* proxy = jsCast<ProxyObject*>(exec->jsCallee());
+    JSValue handlerValue = proxy->handler();
+    if (handlerValue.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue applyMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "apply"), ASCIILiteral("'apply' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSObject* target = proxy->target();
+    if (applyMethod.isUndefined()) {
+        CallData callData;
+        CallType callType = target->methodTable(vm)->getCallData(target, callData);
+        RELEASE_ASSERT(callType != CallType::None);
+        scope.release();
+        return JSValue::encode(call(exec, target, callType, callData, exec->thisValue(), ArgList(exec)));
+    }
+
+    JSArray* argArray = constructArray(exec, static_cast<ArrayAllocationProfile*>(nullptr), ArgList(exec));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(exec->thisValue());
+    arguments.append(argArray);
+    scope.release();
+    return JSValue::encode(call(exec, applyMethod, callType, callData, handler, arguments));
+}
+
+CallType ProxyObject::getCallData(JSCell* cell, CallData& callData)
+{
+    ProxyObject* proxy = jsCast<ProxyObject*>(cell);
+    if (!proxy->m_isCallable) {
+        callData.js.functionExecutable = nullptr;
+        callData.js.scope = nullptr;
+        return CallType::None;
+    }
+
+    callData.native.function = performProxyCall;
+    return CallType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL performProxyConstruct(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return encodedJSValue();
+    }
+    ProxyObject* proxy = jsCast<ProxyObject*>(exec->jsCallee());
+    JSValue handlerValue = proxy->handler();
+    if (handlerValue.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue constructMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "construct"), ASCIILiteral("'construct' property of a Proxy's handler should be constructible"));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSObject* target = proxy->target();
+    if (constructMethod.isUndefined()) {
+        ConstructData constructData;
+        ConstructType constructType = target->methodTable(vm)->getConstructData(target, constructData);
+        RELEASE_ASSERT(constructType != ConstructType::None);
+        scope.release();
+        return JSValue::encode(construct(exec, target, constructType, constructData, ArgList(exec), exec->newTarget()));
+    }
+
+    JSArray* argArray = constructArray(exec, static_cast<ArrayAllocationProfile*>(nullptr), ArgList(exec));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(argArray);
+    arguments.append(exec->newTarget());
+    JSValue result = call(exec, constructMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (!result.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Result from Proxy handler's 'construct' method should be an object"));
+    return JSValue::encode(result);
+}
+
+ConstructType ProxyObject::getConstructData(JSCell* cell, ConstructData& constructData)
+{
+    ProxyObject* proxy = jsCast<ProxyObject*>(cell);
+    if (!proxy->m_isConstructible) {
+        constructData.js.functionExecutable = nullptr;
+        constructData.js.scope = nullptr;
+        return ConstructType::None;
+    }
+
+    constructData.native.function = performProxyConstruct;
+    return ConstructType::Host;
+}
+
+template <typename DefaultDeleteFunction>
+bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, DefaultDeleteFunction performDefaultDelete)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultDelete();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue deletePropertyMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "deleteProperty"), ASCIILiteral("'deleteProperty' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (deletePropertyMethod.isUndefined()) {
+        scope.release();
+        return performDefaultDelete();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, deletePropertyMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (!descriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"));
+            return false;
+        }
+    }
+
+    RETURN_IF_EXCEPTION(scope, false);
+
+    return true;
+}
+
+bool ProxyObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    auto performDefaultDelete = [&] () -> bool {
+        JSObject* target = thisObject->target();
+        return target->methodTable(exec->vm())->deleteProperty(target, exec, propertyName);
+    };
+    return thisObject->performDelete(exec, propertyName, performDefaultDelete);
+}
+
+bool ProxyObject::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    Identifier ident = Identifier::from(exec, propertyName); 
+    auto performDefaultDelete = [&] () -> bool {
+        JSObject* target = thisObject->target();
+        return target->methodTable(exec->vm())->deletePropertyByIndex(target, exec, propertyName);
+    };
+    return thisObject->performDelete(exec, ident.impl(), performDefaultDelete);
+}
+
+bool ProxyObject::performPreventExtensions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue preventExtensionsMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "preventExtensions"), ASCIILiteral("'preventExtensions' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (preventExtensionsMethod.isUndefined()) {
+        scope.release();
+        return target->methodTable(vm)->preventExtensions(target, exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, preventExtensionsMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResultAsBool) {
+        bool targetIsExtensible = target->isExtensible(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (targetIsExtensible) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false"));
+            return false;
+        }
+    }
+
+    return trapResultAsBool;
+}
+
+bool ProxyObject::preventExtensions(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performPreventExtensions(exec);
+}
+
+bool ProxyObject::performIsExtensible(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue isExtensibleMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "isExtensible"), ASCIILiteral("'isExtensible' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    JSObject* target = this->target();
+    if (isExtensibleMethod.isUndefined()) {
+        scope.release();
+        return target->isExtensible(exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, isExtensibleMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool isTargetExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResultAsBool != isTargetExtensible) {
+        if (isTargetExtensible) {
+            ASSERT(!trapResultAsBool);
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true"));
+        } else {
+            ASSERT(!isTargetExtensible);
+            ASSERT(trapResultAsBool);
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false"));
+        }
+    }
+    
+    return trapResultAsBool;
+}
+
+bool ProxyObject::isExtensible(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performIsExtensible(exec);
+}
+
+bool ProxyObject::performDefineOwnProperty(ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSObject* target = this->target();
+    auto performDefaultDefineOwnProperty = [&] {
+        scope.release();
+        return target->methodTable(vm)->defineOwnProperty(target, exec, propertyName, descriptor, shouldThrow);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid())))
+        return performDefaultDefineOwnProperty();
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue definePropertyMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->defineProperty, ASCIILiteral("'defineProperty' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (definePropertyMethod.isUndefined())
+        return performDefaultDefineOwnProperty();
+
+    JSObject* descriptorObject = constructObjectFromPropertyDescriptor(exec, descriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(descriptorObject);
+    JSValue trapResult = call(exec, definePropertyMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor targetDescriptor;
+    bool isTargetDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, targetDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool settingConfigurableToFalse = descriptor.configurablePresent() && !descriptor.configurable();
+
+    if (!isTargetDescriptorDefined) {
+        if (!targetIsExtensible) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible"));
+            return false;
+        }
+        if (settingConfigurableToFalse) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined"));
+            return false;
+        }
+
+        return true;
+    } 
+
+    ASSERT(isTargetDescriptorDefined);
+    bool isCurrentDefined = isTargetDescriptorDefined;
+    const PropertyDescriptor& current = targetDescriptor;
+    bool throwException = false;
+    bool isCompatibleDescriptor = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, targetIsExtensible, descriptor, isCurrentDefined, current, throwException);
+    RETURN_IF_EXCEPTION(scope, false);    
+    if (!isCompatibleDescriptor) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor"));
+        return false;
+    }
+    if (settingConfigurableToFalse && targetDescriptor.configurable()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so"));
+        return false;
+    }
+    
+    return true;
+}
+
+bool ProxyObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->performDefineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
+void ProxyObject::performGetOwnPropertyNames(ExecState* exec, PropertyNameArray& trapResult, EnumerationMode enumerationMode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return;
+    }
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue ownKeysMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "ownKeys"), ASCIILiteral("'ownKeys' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, void());
+    JSObject* target = this->target();
+    if (ownKeysMethod.isUndefined()) {
+        scope.release();
+        target->methodTable(vm)->getOwnPropertyNames(target, exec, trapResult, enumerationMode);
+        return;
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue arrayLikeObject = call(exec, ownKeysMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    PropertyNameMode propertyNameMode = trapResult.mode();
+    RuntimeTypeMask resultFilter = 0;
+    switch (propertyNameMode) {
+    case PropertyNameMode::Symbols:
+        resultFilter = TypeSymbol;
+        break;
+    case PropertyNameMode::Strings:
+        resultFilter = TypeString;
+        break;
+    case PropertyNameMode::StringsAndSymbols:
+        resultFilter = TypeSymbol | TypeString;
+        break;
+    }
+    ASSERT(resultFilter);
+    RuntimeTypeMask dontThrowAnExceptionTypeFilter = TypeString | TypeSymbol;
+    HashSet<UniquedStringImpl*> uncheckedResultKeys;
+
+    auto addPropName = [&] (JSValue value, RuntimeType type) -> bool {
+        static const bool doExitEarly = true;
+        static const bool dontExitEarly = false;
+
+        if (!(type & resultFilter))
+            return dontExitEarly;
+
+        Identifier ident = value.toPropertyKey(exec);
+        RETURN_IF_EXCEPTION(scope, doExitEarly);
+
+        uncheckedResultKeys.add(ident.impl());
+        trapResult.addUnchecked(ident.impl());
+        return dontExitEarly;
+    };
+
+    createListFromArrayLike(exec, arrayLikeObject, dontThrowAnExceptionTypeFilter, ASCIILiteral("Proxy handler's 'ownKeys' method must return an array-like object containing only Strings and Symbols"), addPropName);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    bool targetIsExensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    PropertyNameArray targetKeys(&vm, propertyNameMode);
+    target->methodTable(vm)->getOwnPropertyNames(target, exec, targetKeys, enumerationMode);
+    RETURN_IF_EXCEPTION(scope, void());
+    Vector<UniquedStringImpl*> targetConfigurableKeys;
+    Vector<UniquedStringImpl*> targetNonConfigurableKeys;
+    for (const Identifier& ident : targetKeys) {
+        PropertyDescriptor descriptor;
+        bool isPropertyDefined = target->getOwnPropertyDescriptor(exec, ident.impl(), descriptor); 
+        RETURN_IF_EXCEPTION(scope, void());
+        if (isPropertyDefined && !descriptor.configurable())
+            targetNonConfigurableKeys.append(ident.impl());
+        else
+            targetConfigurableKeys.append(ident.impl());
+    }
+
+    enum ContainedIn { IsContainedIn, IsNotContainedIn };
+    auto removeIfContainedInUncheckedResultKeys = [&] (UniquedStringImpl* impl) -> ContainedIn {
+        auto iter = uncheckedResultKeys.find(impl);
+        if (iter == uncheckedResultKeys.end())
+            return IsNotContainedIn;
+
+        uncheckedResultKeys.remove(iter);
+        return IsContainedIn;
+    };
+
+    for (UniquedStringImpl* impl : targetNonConfigurableKeys) {
+        if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
+            throwVMTypeError(exec, scope, makeString("Proxy object's 'target' has the non-configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            return;
+        }
+    }
+
+    if (targetIsExensible)
+        return;
+
+    for (UniquedStringImpl* impl : targetConfigurableKeys) {
+        if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
+            throwVMTypeError(exec, scope, makeString("Proxy object's non-extensible 'target' has configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            return;
+        }
+    }
+
+    if (uncheckedResultKeys.size()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target"));
+        return;
+    }
+}
+
+void ProxyObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNameArray, EnumerationMode enumerationMode)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    thisObject->performGetOwnPropertyNames(exec, propertyNameArray, enumerationMode);
+}
+
+void ProxyObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNameArray, EnumerationMode enumerationMode)
+{
+    JSObject::getPropertyNames(object, exec, propertyNameArray, enumerationMode);
+}
+
+void ProxyObject::getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ProxyObject::getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    // We should always go down the getOwnPropertyNames path.
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ProxyObject::getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool ProxyObject::performSetPrototype(ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    ASSERT(prototype.isObject() || prototype.isNull());
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue setPrototypeOfMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "setPrototypeOf"), ASCIILiteral("'setPrototypeOf' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    JSObject* target = this->target();
+    if (setPrototypeOfMethod.isUndefined()) {
+        scope.release();
+        return target->setPrototype(vm, exec, prototype, shouldThrowIfCantSet);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(prototype);
+    JSValue trapResult = call(exec, setPrototypeOfMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    
+    if (!trapResultAsBool) {
+        if (shouldThrowIfCantSet)
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed"));
+        return false;
+    }
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (targetIsExtensible)
+        return true;
+
+    JSValue targetPrototype = target->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!sameValue(exec, prototype, targetPrototype)) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false"));
+        return false;
+    }
+
+    return true;
+}
+
+bool ProxyObject::setPrototype(JSObject* object, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    return jsCast<ProxyObject*>(object)->performSetPrototype(exec, prototype, shouldThrowIfCantSet);
+}
+
+JSValue ProxyObject::performGetPrototype(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return { };
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return { };
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getPrototypeOfMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "getPrototypeOf"), ASCIILiteral("'getPrototypeOf' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, { });
+
+    JSObject* target = this->target();
+    if (getPrototypeOfMethod.isUndefined()) {
+        scope.release();
+        return target->getPrototype(vm, exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, getPrototypeOfMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (!trapResult.isObject() && !trapResult.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'getPrototypeOf' trap should either return an object or null"));
+        return { };
+    }
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    if (targetIsExtensible)
+        return trapResult;
+
+    JSValue targetPrototype = target->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    if (!sameValue(exec, targetPrototype, trapResult)) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype"));
+        return { };
+    }
+
+    return trapResult;
+}
+
+JSValue ProxyObject::getPrototype(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performGetPrototype(exec);
+}
+
+void ProxyObject::revoke(VM& vm)
+{ 
+    // This should only ever be called once and we should strictly transition from Object to null.
+    RELEASE_ASSERT(!m_handler.get().isNull() && m_handler.get().isObject());
+    m_handler.set(vm, this, jsNull());
+}
+
+bool ProxyObject::isRevoked() const
+{
+    return handler().isNull();
+}
+
+void ProxyObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_target);
+    visitor.append(thisObject->m_handler);
+}
+
+} // namespace JSC