v8/test/mjsunit/regress/regress-crbug-764219.js
Igor Sheludko b19a1baf49 [ic] Fix storing to JSGlobalProxy having JSProxy in prototype chain.
Bug: chromium:764219
Change-Id: Ic68111e49da508aba255b1c651a85b2b00e62947
Reviewed-on: https://chromium-review.googlesource.com/718108
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48534}
2017-10-13 11:22:30 +00:00

36 lines
548 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f(o) {
o.x = 42;
};
f({});
f(this);
f(this);
})();
(function() {
function f(o) {
o.y = 153;
};
Object.setPrototypeOf(this, new Proxy({}, {}));
f({});
f(this);
f(this);
})();
(function() {
function f(o) {
o.z = 153;
};
Object.setPrototypeOf(this, new Proxy({get z(){}}, {}));
f({});
f(this);
f(this);
})();