1// Copyright 2015 the V8 project authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5function Parent() {} 6 7function Child() {} 8Child.prototype = new Parent(); 9var child = new Child(); 10 11function crash() { 12 return child.__proto__; 13} 14 15crash(); 16crash(); 17 18// Trigger a fast->slow->fast dance of Parent.prototype's map... 19Parent.prototype.__defineSetter__("foo", function() { print("A"); }); 20Parent.prototype.__defineSetter__("foo", function() { print("B"); }); 21// ...and collect more type feedback. 22crash(); 23 24// Now modify the prototype chain. The right cell fails to get invalidated. 25delete Object.prototype.__proto__; 26crash(); 27