v8/test/mjsunit/regress/regress-crbug-702798.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Access any property that's also available on the global of the other realm.
this.__defineGetter__("Object", ()=>0);
__proto__ = Realm.global(Realm.create());
Object;
[ic] Fix 'prototype chain checks' where the holder is the receiver We use LoadFromPrototype also for direct global loads. InitPrototypeChecks did not support this though, and would create a prototype chain check for objects beyond the direct global. This tries to ensure the property on the global itself doesn't exist, which is invalid. Additionally this CL deletes duplicate code. BUG=chromium:702798,v8:5561 Change-Id: I318a5b6cd5f7c3efdb3a003e34edd37d5d3f880b Reviewed-on: https://chromium-review.googlesource.com/457369 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#43935} 2017-03-20 13:19:20 +00:00			`// Copyright 2017 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Access any property that's also available on the global of the other realm.`
Enable --harmony-strict-legacy-accessor-builtins by default This behavior has been staged successfully without a bug report, and has been shipped in the latest versions of Firefox and Safari. Bug: v8:5070 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I084cae2cc303d6a213bd6789297b91656e162d6b Reviewed-on: https://chromium-review.googlesource.com/595129 Reviewed-by: Daniel Ehrenberg <littledan@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#47098} 2017-08-01 00:40:22 +00:00			`this.__defineGetter__("Object", ()=>0);`
[ic] Fix 'prototype chain checks' where the holder is the receiver We use LoadFromPrototype also for direct global loads. InitPrototypeChecks did not support this though, and would create a prototype chain check for objects beyond the direct global. This tries to ensure the property on the global itself doesn't exist, which is invalid. Additionally this CL deletes duplicate code. BUG=chromium:702798,v8:5561 Change-Id: I318a5b6cd5f7c3efdb3a003e34edd37d5d3f880b Reviewed-on: https://chromium-review.googlesource.com/457369 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#43935} 2017-03-20 13:19:20 +00:00			`__proto__ = Realm.global(Realm.create());`
			`Object;`