Version 4.9.385.5 (cherry-pick)

Merged ec30425

[proxy] Reload the initial map after prototype lookup on constructable Proxy.

BUG=chromium:578039
LOG=N
R=hablich@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1602063005

Cr-Commit-Position: refs/branch-heads/4.9@{crosswalk-project#7}
Cr-Branched-From: 2fea296-refs/heads/4.9.385@{crosswalk-project#1}
Cr-Branched-From: 0c1430a-refs/heads/master@{#33306}

include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 4
 #define V8_MINOR_VERSION 9
 #define V8_BUILD_NUMBER 385
-#define V8_PATCH_LEVEL 4
+#define V8_PATCH_LEVEL 5
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

src/objects.cc

@@ -13127,6 +13127,10 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(Isolate* isolate,
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, prototype,
         JSReceiver::GetProperty(new_target, prototype_string), Map);
+    // The above prototype lookup might change the constructor and its
+    // prototype, hence we have to reload the initial map.
+    EnsureHasInitialMap(constructor);
+    constructor_initial_map = handle(constructor->initial_map(), isolate);
   }
 
   // If prototype is not a JSReceiver, fetch the intrinsicDefaultProto from the

test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function target() {};
+
+var proxy = new Proxy(target, {
+  get() {
+    // Reset the initial map of the target.
+    target.prototype = 123;
+  }});
+
+new proxy();