AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

One more LookupIterator indexed/named mode fix

Browse Source 
Reported at comment #18 of the linked bug.

Bug: chromium:1027461
Change-Id: I64fb4c4edd4df07ddf86c508dfecec7f509efc9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940262
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65263}
This commit is contained in:
Jakob Kummerow 2019-11-28 12:20:47 +01:00 committed by Commit Bot
parent 16342a4b73
commit c6f16db2d6
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/objects/js-objects.cc
View File

@ -262,7 +262,10 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
}
if (use_set) {
LookupIterator it(target, next_key, target);
bool success;
LookupIterator it = LookupIterator::PropertyOrElement(isolate, target,
next_key, &success);
CHECK(success);
Maybe<bool> result =
Object::SetProperty(&it, prop_value, StoreOrigin::kNamed,
Just(ShouldThrow::kThrowOnError));

7
test/mjsunit/regress/large-indices.js
View File

@ -97,3 +97,10 @@
obj[9007199254740991] = 1;
Object.values(obj);
})();
// crbug.com/1027461#c18
(function() {
const v7 = Object(1);
v7[4294967297] = 1;
const v8 = Object.assign({}, v7);
})();