v8/test/mjsunit/regress/regress-crbug-666742.js
ishell 8ca50a8862 [ic] Ensure prototype validity cell guards global object's prototype changes for LoadGlobalIC.
BUG=chromium:666742, v8:5561

Review-Url: https://codereview.chromium.org/2512183002
Cr-Commit-Position: refs/heads/master@{#41136}
2016-11-21 12:46:44 +00:00

16 lines
339 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var p = {x:1};
__proto__ = p;
assertEquals(x, 1);
__proto__ = {x:13};
assertEquals(x, 13);
__proto__ = {x:42};
p = null;
gc();
assertEquals(x, 42);