js/src/jit-test/tests/proxy/bug1853180-2.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// |jit-test| --fast-warmup

function foo(o) {
  return o.x;
}

with ({}) {}

var trigger = false;

var handler = {
  get: (target, prop) => {
    if (trigger) {
      transplant(newGlobal({newCompartment: true}));
    }
    return 1;
  },
  getOwnPropertyDescriptor: (target, prop) => {
    return Object.getOwnPropertyDescriptor(target, prop);
  }
}

let {object, transplant} = transplantableObject();
Object.defineProperty(object, 'x', { value: 1, configurable: false, writable: false });

var proxy = new Proxy(object, handler);
for (var i = 0; i < 50; i++) {
  foo(proxy);
}

trigger = true;
foo(proxy);