1 files changed, 14 insertions, 4 deletions
diff --git a/Source/JavaScriptCore/runtime/JSProxy.cpp b/Source/JavaScriptCore/runtime/JSProxy.cpp
index 7108dcfa0..e0f9d69e6 100644
--- a/Source/JavaScriptCore/runtime/JSProxy.cpp
+++ b/Source/JavaScriptCore/runtime/JSProxy.cpp
@@ -27,6 +27,7 @@
 #include "JSProxy.h"
 
 #include "JSGlobalObject.h"
+#include "Operations.h"
 
 namespace JSC {
 
@@ -46,12 +47,21 @@ void JSProxy::visitChildren(JSCell* cell, SlotVisitor& visitor)
     visitor.append(&thisObject->m_target);
 }
 
-void JSProxy::setTarget(JSGlobalData& globalData, JSGlobalObject* globalObject)
+void JSProxy::setTarget(VM& vm, JSGlobalObject* globalObject)
 {
     ASSERT_ARG(globalObject, globalObject);
-    m_target.set(globalData, this, globalObject);
-    setPrototype(globalData, globalObject->prototype());
-    resetInheritorID(globalData);
+    m_target.set(vm, this, globalObject);
+    setPrototype(vm, globalObject->prototype());
+
+    PrototypeMap& prototypeMap = vm.prototypeMap;
+    if (!prototypeMap.isPrototype(this))
+        return;
+
+    // This is slow but constant time. We think it's very rare for a proxy
+    // to be a prototype, and reasonably rare to retarget a proxy,
+    // so slow constant time is OK.
+    for (size_t i = 0; i <= JSFinalObject::maxInlineCapacity(); ++i)
+        prototypeMap.clearEmptyObjectStructureForPrototype(this, i);
 }
 
 String JSProxy::className(const JSObject* object)