blob: 889fcaf7b0ccecfb5a57db8855317f40b94b49e7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
// Test for invalidating shape teleporting when transplanting objects on proto
// chains.
function checkGetProp(obj, expected) {
for (var i = 0; i < 50; i++) {
assertEq(obj.prop, expected);
}
}
Object.prototype.prop = 1234;
// Construct the following proto chain:
//
// receiver => protoA (FakeDOMObject) => protoB {prop: 567} => null
const protoB = Object.create(null);
protoB.prop = 567;
const protoA = new FakeDOMObject();
Object.setPrototypeOf(protoA, protoB);
const receiver = Object.create(protoA);
// Ensure all objects we allocated are tenured. This way we don't need to trigger
// a GC later in TransplantableObject, which makes the test more reliable.
gc();
// Attach an IC for `receiver.prop`.
checkGetProp(receiver, 567);
// Swap protoA with another object. This must invalidate shape teleporting,
// because the proto chain of `receiver` now looks like this:
//
// receiver => protoA (new FakeDOMObject) => FakeDOMObject.prototype => Object.prototype => null
const {transplant} = transplantableObject({object: protoA});
transplant(this);
// `receiver.prop` now gets `prop` from Object.prototype.
checkGetProp(receiver, 1234);
|
