Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 16 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/basic/shape-teleporting-transplant-2.js b/js/src/jit-test/tests/basic/shape-teleporting-transplant-2.js
new file mode 100644
index 0000000000..b3b7189ceb
--- /dev/null
+++ b/js/src/jit-test/tests/basic/shape-teleporting-transplant-2.js
@@ -0,0 +1,16 @@
+// Put DOM object on prototype chain
+let x = new FakeDOMObject;
+let y = Object.create(x);
+
+// Transplant the DOM object while it is still a prototype
+let g = newGlobal({newCompartment: true});
+let { transplant } = transplantableObject({ object: x });
+
+// JIT an IC to access Object.prototype.toString
+function f(o) { return o.toString; }
+for (var i = 0; i < 20; ++i) { f(y) }
+
+// Transplanting should not interfere with teleporting
+transplant(g);
+x.toString = "override";
+assertEq(f(y), "override");