AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Relax a too-strict DCHECKs.

Browse Source 
This allows updates to SLOW_STRING_WRAPPER_ELEMENTS elements kind
for non-extensible map (so far only dictionary elements and typed-array
elements were allowed).

Bug: chromium:932101
Change-Id: Id532684aa94f908eb14f3451aa823f282342668b
Reviewed-on: https://chromium-review.googlesource.com/c/1475390
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59621}
This commit is contained in:
Jaroslav Sevcik 2019-02-15 07:45:20 +01:00 committed by Commit Bot
parent 634a29a0ff
commit 0f6f064c9e
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/map-updater.cc
View File

@ -324,6 +324,7 @@ MapUpdater::State MapUpdater::FindRootMap() {
// We want to build transitions to the original element kind (before
// the seal transitions), so change {to_kind} accordingly.
DCHECK(to_kind == DICTIONARY_ELEMENTS ||
to_kind == SLOW_STRING_WRAPPER_ELEMENTS ||
IsFixedTypedArrayElementsKind(to_kind));
to_kind = integrity_source_map_->elements_kind();
}

11
test/mjsunit/regress-932101.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
o = Object("A");
o.x = 1;
Object.seal(o);
o.x = 0.1
o[1] = "b";
assertEquals(undefined, o[1]);