bug1853180-2.js (609B)
1 // |jit-test| --fast-warmup 2 3 function foo(o) { 4 return o.x; 5 } 6 7 with ({}) {} 8 9 var trigger = false; 10 11 var handler = { 12 get: (target, prop) => { 13 if (trigger) { 14 transplant(newGlobal({newCompartment: true})); 15 } 16 return 1; 17 }, 18 getOwnPropertyDescriptor: (target, prop) => { 19 return Object.getOwnPropertyDescriptor(target, prop); 20 } 21 } 22 23 let {object, transplant} = transplantableObject(); 24 Object.defineProperty(object, 'x', { value: 1, configurable: false, writable: false }); 25 26 var proxy = new Proxy(object, handler); 27 for (var i = 0; i < 50; i++) { 28 foo(proxy); 29 } 30 31 trigger = true; 32 foo(proxy);