24 lines
601 B
JavaScript
24 lines
601 B
JavaScript
|
// Copyright 2020 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
// Flags: --allow-natives-syntax
|
||
|
|
|
||
|
|
(function main() {
|
||
|
|
eval();
|
||
|
|
function foo() {
|
||
|
|
bla = [];
|
||
|
|
bla.__proto__ = '';
|
||
|
|
}
|
||
|
|
%PrepareFunctionForOptimization(foo);
|
||
|
|
foo();
|
||
|
|
Object.defineProperty(this, 'bla',
|
||
|
|
{value: bla, configurable: false, writable: true});
|
||
|
|
foo();
|
||
|
|
%OptimizeFunctionOnNextCall(foo);
|
||
|
|
foo();
|
||
|
|
Object.defineProperty(this, 'bla',
|
||
|
|
{value: bla, configurable: false, writable: false});
|
||
|
|
foo();
|
||
|
|
})();
|