src/third_party/v8/test/mjsunit/regress/regress-crbug-1055138-2.js

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

Object.prototype[1] = 153;

(function TestSloppyStoreToReadOnlyProperty() {
  function foo(prototype_frozen) {
    let ar = [];
    for (let i = 0; i < 3; i++) {
      ar[i] = 42;

      if (prototype_frozen) {
        if (i == 1) {
          // Attempt to overwrite read-only element should not change
          // array length.
          assertEquals(1, ar.length);
        } else {
          assertEquals(i + 1, ar.length);
        }
      }
    }
    return ar;
  }

  // Warm-up store IC.
  assertEquals([42,42,42], foo(false));
  assertEquals([42,42,42], foo(false));
  assertEquals([42,42,42], foo(false));
  assertEquals([42,42,42], foo(false));
  Object.freeze(Object.prototype);
  // Ensure IC was properly invalidated.
  assertEquals([42,153,42], foo(true));
})();