1// Copyright 2014 the V8 project authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5 6function TestFunctionPrototypeSetter() { 7 var f = function() {}; 8 var o = {__proto__: f}; 9 o.prototype = 42; 10 assertEquals(42, o.prototype); 11 assertTrue(o.hasOwnProperty('prototype')); 12} 13TestFunctionPrototypeSetter(); 14 15 16function TestFunctionPrototypeSetterOnValue() { 17 var f = function() {}; 18 var fp = f.prototype; 19 Number.prototype.__proto__ = f; 20 var n = 42; 21 var o = {}; 22 n.prototype = o; 23 assertEquals(fp, n.prototype); 24 assertEquals(fp, f.prototype); 25 assertFalse(Number.prototype.hasOwnProperty('prototype')); 26} 27TestFunctionPrototypeSetterOnValue(); 28 29 30function TestArrayLengthSetter() { 31 var a = [1]; 32 var o = {__proto__: a}; 33 o.length = 2; 34 assertEquals(2, o.length); 35 assertEquals(1, a.length); 36 assertTrue(o.hasOwnProperty('length')); 37} 38TestArrayLengthSetter(); 39 40 41function TestArrayLengthSetterOnValue() { 42 Number.prototype.__proto__ = [1]; 43 var n = 42; 44 n.length = 2; 45 assertEquals(1, n.length); 46 assertFalse(Number.prototype.hasOwnProperty('length')); 47} 48TestArrayLengthSetterOnValue(); 49