v8/test/mjsunit/regress/regress-crbug-571517.js

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

function Receiver() { this.receiver = "receiver"; }
function Proto() { this.proto = "proto"; }

function f(a) {
  return a.foo;
}

var rec = new Receiver();

// Formerly, this mutated rec.__proto__.__proto__, but
// the global object prototype chain is now immutable;
// not sure if this test now hits the original hazard case.
var proto = rec.__proto__;

// Initialize prototype chain dependent IC (nonexistent load).
assertEquals(undefined, f(rec));
assertEquals(undefined, f(rec));

// Add a new prototype to the end of the chain.
var p2 = new Proto();
p2.__proto__ = null;
proto.__proto__ = p2;

// Update the IC.
assertEquals(undefined, f(rec));

// Now modify the most recently added prototype by adding a property...
p2.foo = "bar";
assertEquals("bar", f(rec));

// ...and removing it again. Due to missing prototype user registrations,
// this fails to invalidate the IC.
delete p2.foo;
p2.secret = "GAME OVER";
assertEquals(undefined, f(rec));