test/mjsunit/regress/regress-3462.js

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.


function TestFunctionPrototypeSetter() {
  var f = function() {};
  var o = {__proto__: f};
  o.prototype = 42;
  assertEquals(42, o.prototype);
  assertTrue(o.hasOwnProperty('prototype'));
}
TestFunctionPrototypeSetter();


function TestFunctionPrototypeSetterOnValue() {
  var f = function() {};
  var fp = f.prototype;
  Number.prototype.__proto__ = f;
  var n = 42;
  var o = {};
  n.prototype = o;
  assertEquals(fp, n.prototype);
  assertEquals(fp, f.prototype);
  assertFalse(Number.prototype.hasOwnProperty('prototype'));
}
TestFunctionPrototypeSetterOnValue();


function TestArrayLengthSetter() {
  var a = [1];
  var o = {__proto__: a};
  o.length = 2;
  assertEquals(2, o.length);
  assertEquals(1, a.length);
  assertTrue(o.hasOwnProperty('length'));
}
TestArrayLengthSetter();


function TestArrayLengthSetterOnValue() {
  Number.prototype.__proto__ = [1];
  var n = 42;
  n.length = 2;
  assertEquals(1, n.length);
  assertFalse(Number.prototype.hasOwnProperty('length'));
}
TestArrayLengthSetterOnValue();