B.3.1 __proto__ Property Names in Object Initializers
PropertyDefinition : PropertyName : AssignmentExpression
Step 6.a.i
If `propValue` is a Proxy its [[GetPrototypeOf]] method will be called when the default ordinary [[SetPrototypeOf]] is invoked. And that means user code may get executed.
I wonder if it makes sense to change this step to make a direct assignment to [[Prototype]]. The proto cycle chain check from [[SetPrototypeOf]] is not needed at this point and less intervening user code is always preferable ;-)
see Bug 2437
Evaluation routines at this level shouldn't be bypassing the MOP.
On the other hand, 9.1.2 probably shouldn't bother to call non-ordinary [[GetPrototypeOf]]
Fixed in rev33 editor's draft
I changed ordinary [[SetPrototypeOf]] so it so longer calls [[GetPrototypeOf]] to on the new __proto__ value.
See Bug 2437
That eliminates the user code concern.
fixed in rev33