AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[Runtime] Set expected_nof_properties when creating Constructors

Browse Source 
Bug: chromium:800032
Change-Id: I2ba740a3617df3652475e8fc5bd8e8e33cb14a0d
Reviewed-on: https://chromium-review.googlesource.com/861886
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50526}
This commit is contained in:
Camillo Bruni 2018-01-12 10:55:10 +01:00 committed by Commit Bot
parent 7f01c9303f
commit 42e8ca9995
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/factory.cc
View File

@ -1606,6 +1606,7 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
}
Handle<Map> initial_map = NewMap(args.type_, args.instance_size_,
elements_kind, args.inobject_properties_);
result->shared()->set_expected_nof_properties(args.inobject_properties_);
// TODO(littledan): Why do we have this is_generator test when
// NewFunctionPrototype already handles finding an appropriately
// shared prototype?

22
test/mjsunit/regress/regress-crbug-800032.js Normal file
View File

@ -0,0 +1,22 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc
class Derived extends RegExp {
constructor(a) {
// Syntax Error
const a = 1;
}
}
let o = Reflect.construct(RegExp, [], Derived);
%HeapObjectVerify(o);
// Check that we can properly access lastIndex.
assertEquals(o.lastIndex, 0);
o.lastIndex = 1;
assertEquals(o.lastIndex, 1);
o.lastIndex = 0;
gc();