summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/cacheir/new-with-non-object-prototype-failure.js
blob: 7ecbbe36c4f9f9a4dcf429f97aa11f857b57420b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
// Test failure when constructing a function whose |.prototype| property isn't an object.

function Klass() {
  this.prop = 1;
}

// Save the original prototype.
const KlassPrototype = Klass.prototype;

// Set the prototype to a non-object value.
Klass.prototype = null;

const prototypes = [
  null,
  KlassPrototype,
];

const N = 500;
let c = 0;

for (let i = 0; i <= N; ++i) {
  // Always perform a set to avoid a cold-code bailout.
  let proto = prototypes[(i === N)|0];
  Klass.prototype = proto;

  // Create a new object.
  let o = new Klass();

  // Read a property from the new object to ensure it was correctly allocated
  // and initialised.
  c += o.prop;

  // The prototype defaults to %Object.prototype% when the |.prototype|
  // property isn't an object.
  assertEq(Object.getPrototypeOf(o), proto === null ? Object.prototype : KlassPrototype);
}

assertEq(c, N + 1);