v8/test/mjsunit/regress/regress-3462.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

49 lines
1.2 KiB
JavaScript
Raw Normal View History

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function TestFunctionPrototypeSetter() {
var f = function() {};
var o = {__proto__: f};
o.prototype = 42;
assertEquals(42, o.prototype);
assertTrue(o.hasOwnProperty('prototype'));
}
TestFunctionPrototypeSetter();
function TestFunctionPrototypeSetterOnValue() {
var f = function() {};
var fp = f.prototype;
Number.prototype.__proto__ = f;
var n = 42;
var o = {};
n.prototype = o;
assertEquals(fp, n.prototype);
assertEquals(fp, f.prototype);
assertFalse(Number.prototype.hasOwnProperty('prototype'));
}
TestFunctionPrototypeSetterOnValue();
function TestArrayLengthSetter() {
var a = [1];
var o = {__proto__: a};
o.length = 2;
assertEquals(2, o.length);
assertEquals(1, a.length);
assertTrue(o.hasOwnProperty('length'));
}
TestArrayLengthSetter();
function TestArrayLengthSetterOnValue() {
Number.prototype.__proto__ = [1];
var n = 42;
n.length = 2;
assertEquals(1, n.length);
assertFalse(Number.prototype.hasOwnProperty('length'));
}
TestArrayLengthSetterOnValue();