1 // Copyright 2014 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 6 function TestFunctionPrototypeSetter() { 7 var f = function() {}; 8 var o = {__proto__: f}; 9 o.prototype = 42; 10 assertEquals(42, o.prototype); 11 assertTrue(o.hasOwnProperty('prototype')); 12 } 13 TestFunctionPrototypeSetter(); 14 15 16 function TestFunctionPrototypeSetterOnValue() { 17 var f = function() {}; 18 var fp = f.prototype; 19 Number.prototype.__proto__ = f; 20 var n = 42; 21 var o = {}; 22 n.prototype = o; 23 assertEquals(fp, n.prototype); 24 assertEquals(fp, f.prototype); 25 assertFalse(Number.prototype.hasOwnProperty('prototype')); 26 } 27 TestFunctionPrototypeSetterOnValue(); 28 29 30 function TestArrayLengthSetter() { 31 var a = [1]; 32 var o = {__proto__: a}; 33 o.length = 2; 34 assertEquals(2, o.length); 35 assertEquals(1, a.length); 36 assertTrue(o.hasOwnProperty('length')); 37 } 38 TestArrayLengthSetter(); 39 40 41 function TestArrayLengthSetterOnValue() { 42 Number.prototype.__proto__ = [1]; 43 var n = 42; 44 n.length = 2; 45 assertEquals(1, n.length); 46 assertFalse(Number.prototype.hasOwnProperty('length')); 47 } 48 TestArrayLengthSetterOnValue(); 49
