e395871fdb
The compiler assumes (for loads) that the property cell of a non-configurable global property never gets invalidated. Bug: chromium:1044919 Change-Id: I27f6ce30fb9a21e2c1e5310f25e9bb973ebbc266 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023562 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66021}
24 lines
601 B
JavaScript
24 lines
601 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function main() {
|
|
eval();
|
|
function foo() {
|
|
bla = [];
|
|
bla.__proto__ = '';
|
|
}
|
|
%PrepareFunctionForOptimization(foo);
|
|
foo();
|
|
Object.defineProperty(this, 'bla',
|
|
{value: bla, configurable: false, writable: true});
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
Object.defineProperty(this, 'bla',
|
|
{value: bla, configurable: false, writable: false});
|
|
foo();
|
|
})();
|