Wrong function prototype lookup after setPrototypeOf

[barak007]

Hi,
Sadly I can't reproduce the issue in minimal way but the behavior I'm experiencing in edge 44 is that a function prototype is being changed without any triggers from my side.

This is the basic idea of the broken setup.

I have a factory of functions:

function create(value, obj){
    ...
    function inner(){ ... }
    obj.someField = value
    /* override function prototype */
    Object.setPrototypeOf(inner, obj)
    return inner
}

The factory is used to create function instances

// usage of the factory
const f1 = create('1', {$: true})
const f2 = create('2', {$: true}) // this will be the test subject

Then, later on in code, f2 is being passed as an argument to another function. Here's a simplified version of that one:

function test(fn /* passing f2 */){
  console.log(fn.someField) // logs 2
  const values = ['someField'].map((key)=>fn[key]) // something went wrong here
  console.log(fn.someField) // logs 1, should log 2
}

It appears the second .someField lookup (inside the second console.log) gets the prototype of f1 instead of f2. Behavior suggests this is a JS engine caching issue for prototype lookup.

Same code functions properly in Chrome/FF.

I have managed to work around the issue by setting a property on the function itself:

function create(value, obj){
    ...
    function inner(){ ... }
    obj.someField = value
    /* override function prototype */
    Object.setPrototypeOf(inner, obj)
    inner.workAround = Math.random()
    return inner
}

maybe related to #5915

[rhuanjl]

This doesn't repro in 1.11 or master so closing as assumed already fixed.