shape-teleporting-transplant-1.js (1166B)
1 // Test for invalidating shape teleporting when transplanting objects on proto 2 // chains. 3 4 function checkGetProp(obj, expected) { 5 for (var i = 0; i < 50; i++) { 6 assertEq(obj.prop, expected); 7 } 8 } 9 10 Object.prototype.prop = 1234; 11 12 // Construct the following proto chain: 13 // 14 // receiver => protoA (FakeDOMObject) => protoB {prop: 567} => null 15 const protoB = Object.create(null); 16 protoB.prop = 567; 17 const protoA = new FakeDOMObject(); 18 Object.setPrototypeOf(protoA, protoB); 19 const receiver = Object.create(protoA); 20 21 // Ensure all objects we allocated are tenured. This way we don't need to trigger 22 // a GC later in TransplantableObject, which makes the test more reliable. 23 gc(); 24 25 // Attach an IC for `receiver.prop`. 26 checkGetProp(receiver, 567); 27 28 // Swap protoA with another object. This must invalidate shape teleporting, 29 // because the proto chain of `receiver` now looks like this: 30 // 31 // receiver => protoA (new FakeDOMObject) => FakeDOMObject.prototype => Object.prototype => null 32 const {transplant} = transplantableObject({object: protoA}); 33 transplant(this); 34 35 // `receiver.prop` now gets `prop` from Object.prototype. 36 checkGetProp(receiver, 1234);