Ask an exotic global prototype for a bare identifier through [[Get]]

[lahma]

GlobalEnvironment.TryGetFromGlobalPrototype resolved the direct prototype with TryGetOwnPropertyValue — that is [[GetOwnProperty]], so a Proxy installed as the global's prototype saw its getOwnPropertyDescriptor trap and never its get. Levels two and deeper were already spec-shaped (HasProperty + Get(name, global)), so the defect was exactly one level deep — and it made HasBinding and the value read contradict each other:

var p = new Proxy({}, { has: (t, k) => k === 'virt', get: () => 'VIRTUAL' });
Object.setPrototypeOf(globalThis, p);
typeof virt           // node: "string"    Jint: "undefined"
virt                  // node: "VIRTUAL"   Jint: ReferenceError: virt is not defined
'virt' in globalThis  // both: true
globalThis.virt       // both: "VIRTUAL"

Pre-existing, but aggravated by #2928: before it, typeof also answered "undefined", so the engine was at least self-consistent. Now it reports the binding exists and the read throws.

test262 covers this and we do not run it. test/staging/sm/Proxy/global-receiver.js asserts the global is the receiver handed to a Proxy's get and set traps when the Proxy is the global's prototype. Run by hand through the REPL: before, ReferenceError: bareword is not defined at the first assertion; after, PASS gets=1 sets=1. The harness emits only annexB, built-ins, intl402 and language, so staging/ never reaches the suite. It is now pinned in-repo as ExoticGlobalPrototypeTests.Test262StagingGlobalReceiver.

The gate is InternalTypes.ExoticGet — the bit behind PropertyAccessSemantics.Exotic — not a is JsProxy type test, so a host object that overrides Get gets the same answer, and one that overrides Get but declares Ordinary keeps the shortcut, which is exactly what that declaration promises. Level 1 and levels 2+ now share one body.

The shortcut is kept for ordinary prototypes because it is load-bearing: it lets a host prototype answer without building a descriptor it would throw away. An ordinary prototype now additionally executes a load of prototype._type, an AND with a constant and a not-taken branch — a same-cache-line load feeding a predictable branch, on a method that is already NoInlining and is reached only after the global's own lookup and its shape lookup have both missed. No new call, no new allocation, no change in virtual dispatch count.

8 new tests, 4 red on main on both net10.0 and net472. The 4 that passed cold were the set-trap and level-2 cases, isolating the defect. Verification leg green.

🤖 Generated with Claude Code