Object.defineProperty, on a proxy, goes through external API which doesn't have the right semantics. We should make it go through the right internal API, which is a little tricky since not enough data is passed around. This patch passes Jeff's Object.defineProperty tests if I make it wrap incoming objects. Brendan says: > Could you go slightly further and s/ESPropertyDescriptor/PropDesc/g so we > wouldn't have yet another such thing (albeit a subtype)? I.e., keep the subtype > relation but merge the new one into the PropDesc one added to jsobj.* for ES5. So I'll do that next.

I hadn't seen this patch, and I went and reproduced about half of the work in jsdbg2 branch. I really should read this patch before landing that. Btw, it turns out this was actually spec'd with the wrong semantics that we implement; I sent email to es-discuss and they fixed it in the wiki (hence the distinction between ToPropertyDescriptor and ToCompletePropertyDescriptor now). http://wiki.ecmascript.org/doku.php?id=harmony:proxies_semantics So this bug was INVALID all this time, but not anymore. :-\