Proxy objects do not inherit internal slots of their target.

Author: iamstolis

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/builtins/ObjectPrototypeBuiltins.java

@@ -85,7 +85,6 @@
 import com.oracle.truffle.js.runtime.builtins.BuiltinEnum;
 import com.oracle.truffle.js.runtime.builtins.JSClass;
 import com.oracle.truffle.js.runtime.builtins.JSOrdinary;
-import com.oracle.truffle.js.runtime.builtins.JSProxy;
 import com.oracle.truffle.js.runtime.objects.JSLazyString;
 import com.oracle.truffle.js.runtime.objects.JSObject;
 import com.oracle.truffle.js.runtime.objects.Null;
@@ -309,12 +308,13 @@ protected String doJSObject(DynamicObject thisObj,
         @Specialization(guards = "isJSProxy(thisObj)")
         protected String doJSProxy(DynamicObject thisObj,
                         @Shared("builtinTag") @Cached("create()") GetBuiltinToStringTagNode getBuiltinToStringTagNode) {
-            Object target = JSProxy.getTargetNonProxy(thisObj);
-            String toString = getToStringTag(thisObj);
-            if (toString == null) {
-                toString = getBuiltinToStringTagNode.execute(target);
+            // builtinTag must be read before tag because the latter may revoke the proxy
+            String builtinTag = getBuiltinToStringTagNode.execute(thisObj);
+            String tag = getToStringTag(thisObj);
+            if (tag == null) {
+                tag = builtinTag;
             }
-            return formatString(toString);
+            return formatString(tag);
         }
 
         @Specialization(guards = "isJSNull(thisObj)")

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/builtins/JSProxy.java

@@ -548,7 +548,13 @@ public boolean isExtensible(DynamicObject thisObj) {
     public String getBuiltinToStringTag(DynamicObject object) {
         Object targetNonProxy = getTargetNonProxy(object);
         if (JSDynamicObject.isJSDynamicObject(targetNonProxy)) {
-            return JSObject.getJSClass((DynamicObject) targetNonProxy).getBuiltinToStringTag((DynamicObject) targetNonProxy);
+            if (JSArray.isJSArray(targetNonProxy)) {
+                return JSArray.CLASS_NAME;
+            } else if (JSFunction.isJSFunction(targetNonProxy)) {
+                return JSFunction.CLASS_NAME;
+            } else {
+                return "Object";
+            }
         } else {
             return "Foreign";
         }