19 lines
543 B
JavaScript
19 lines
543 B
JavaScript
|
// Copyright 2023 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
let a = {p0: 1, p1: 1, p2: 1, p3: 1, p4: 1, p5: 1, p6: 1, p7: 1, p8: 1};
|
||
|
|
a.p9 = 1;
|
||
|
|
function throwaway() {
|
||
|
|
return {...a, __proto__: null};
|
||
|
|
}
|
||
|
|
for (let j = 0; j < 100; ++j) // IC
|
||
|
|
throwaway();
|
||
|
|
for (let key in a) a[key] = {};
|
||
|
|
function func() {
|
||
|
|
return {...a, __proto__: null};
|
||
|
|
}
|
||
|
|
for (let j = 0; j < 100; ++j) // IC
|
||
|
|
corrupted = func();
|
||
|
|
corrupted.p9 = 0x42424242 >> 1;
|