@@ -0,0 +1,73 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${actual}`);
+}
+
+function makePolyProtoObject() {
+    function foo() {
+        class C {
+            constructor() { this._field = 42; }
+        };
+        return new C;
+    }
+    for (let i = 0; i < 15; ++i)
+        foo();
+    return foo();
+}
+
+// A poly-proto object stores its prototype in the object rather than in its structure, so
+// Object.setPrototypeOf leaves its StructureID untouched. The Proxy handler-traps cache must not
+// treat a matching StructureID as proof that the prototype is still an object.
+
+{
+    let handler = makePolyProtoObject();
+    Object.setPrototypeOf(handler, Object.prototype);
+    handler.get = (target, key) => `got ${key}`;
+
+    let proxy = new Proxy({ }, handler);
+    shouldBe(proxy.foo, "got foo");
+
+    Object.setPrototypeOf(handler, null);
+    shouldBe(proxy.foo, "got foo");
+    shouldBe(proxy.bar, "got bar");
+}
+
+{
+    let handler = makePolyProtoObject();
+    Object.setPrototypeOf(handler, Object.prototype);
+
+    let proxy = new Proxy({ a: 1 }, handler);
+    shouldBe(Object.keys(proxy).join(), "a");
+
+    Object.setPrototypeOf(handler, null);
+    shouldBe(Object.keys(proxy).join(), "a");
+
+    handler.ownKeys = () => ["b"];
+    handler.getOwnPropertyDescriptor = () => ({ value: 2, enumerable: true, configurable: true });
+    shouldBe(Object.keys(proxy).join(), "b");
+}
+
+{
+    let handler = makePolyProtoObject();
+    Object.setPrototypeOf(handler, Object.prototype);
+    handler.get = function (target, key) {
+        Object.setPrototypeOf(handler, null);
+        return 42;
+    };
+
+    let proxy = new Proxy({ }, handler);
+    shouldBe(proxy.foo, 42);
+    shouldBe(proxy.foo, 42);
+}
+
+// A poly-proto handler whose prototype gains a trap must pick the new trap up.
+{
+    let handler = makePolyProtoObject();
+    Object.setPrototypeOf(handler, Object.prototype);
+
+    let proxy = new Proxy({ foo: 1 }, handler);
+    shouldBe(proxy.foo, 1);
+
+    Object.setPrototypeOf(handler, { get: () => "from prototype" });
+    shouldBe(proxy.foo, "from prototype");
+}
@@ -1831,8 +1831,8 @@ static ALWAYS_INLINE void directPutByValOptimize(JSGlobalObject* globalObject, C
             AccessType accessType = static_cast<AccessType>(propertyCache->accessType);
             PutPropertySlot slot(baseValue, isStrict, codeBlock->putByIdContext());
 
-            Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue);
-            CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, identifier, value, slot);
+            Structure* structure = nullptr;
+            CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, identifier, value, slot, &structure);
 
             RETURN_IF_EXCEPTION(scope, void());
 
 
@@ -1079,7 +1079,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
 
     Structure* oldStructure = baseValue.isCell() ? baseValue.asCell()->structure() : nullptr;
     if (bytecode.m_flags.isDirect())
-        CommonSlowPaths::putDirectWithReify(vm, globalObject, asObject(baseValue), ident, getOperand(callFrame, bytecode.m_value), slot);
+        CommonSlowPaths::putDirectWithReify(vm, globalObject, asObject(baseValue), ident, getOperand(callFrame, bytecode.m_value), slot, &oldStructure);
     else
         baseValue.putInline(globalObject, ident, getOperand(callFrame, bytecode.m_value), slot);
     LLINT_CHECK_EXCEPTION();
 
@@ -124,7 +124,9 @@ JSObject* ProxyObject::getHandlerTrap(JSGlobalObject* globalObject, JSObject* ha
     bool isSlotCacheable = slot.isUnset() || (slot.isCacheableValue() && slot.slotBase() == handler);
     if (isSlotCacheable) {
         JSValue handlerPrototype = handler->getPrototypeDirect();
-        bool isHandlerPrototypeChainCacheable = handler->type() == FinalObjectType && !handler->structure()->isDictionary()
+        // isHandlerTrapsCacheValid treats a matching handler StructureID as proof that the prototype is
+        // unchanged, which only holds for mono-proto: setPrototypeOf on a poly-proto object keeps its structure.
+        bool isHandlerPrototypeChainCacheable = handler->type() == FinalObjectType && handler->structure()->hasMonoProto() && !handler->structure()->isDictionary()
             && handlerPrototype.inherits<ObjectPrototype>() && !asObject(handlerPrototype)->structure()->isDictionary();
         if (isHandlerPrototypeChainCacheable) {
             ASSERT(slot.cachedOffset() != emptyHandlerTrapCache);
 
@@ -144,7 +144,10 @@ class ProxyObject final : public JSInternalFieldObjectImpl<2> {
 
 ALWAYS_INLINE bool ProxyObject::isHandlerTrapsCacheValid(JSObject* handler)
 {
-    return handler->structureID() == m_handlerStructureID.value() && asObject(handler->getPrototypeDirect())->structureID() == m_handlerPrototypeStructureID.value();
+    if (handler->structureID() != m_handlerStructureID.value())
+        return false;
+    ASSERT(handler->structure()->hasMonoProto());
+    return asObject(handler->getPrototypeDirect())->structureID() == m_handlerPrototypeStructureID.value();
 }
 
 } // namespace JSC
Original file line number	Diff line number	Diff line change
`@@ -144,7 +144,10 @@ class ProxyObject final : public JSInternalFieldObjectImpl<2> {`
`144`	`144`
`145`	`145`	`ALWAYS_INLINE bool ProxyObject::isHandlerTrapsCacheValid(JSObject* handler)`
`146`	`146`	`{`
`147`		`- return handler->structureID() == m_handlerStructureID.value() && asObject(handler->getPrototypeDirect())->structureID() == m_handlerPrototypeStructureID.value();`
	`147`	`+ if (handler->structureID() != m_handlerStructureID.value())`
	`148`	`+ return false;`
	`149`	`+ ASSERT(handler->structure()->hasMonoProto());`
	`150`	`+ return asObject(handler->getPrototypeDirect())->structureID() == m_handlerPrototypeStructureID.value();`
`148`	`151`	`}`
`149`	`152`
`150`	`153`	`} // namespace JSC`