15cc02b4e8
Shared objects have fixed layout (i.e. immutable maps) and start off sealed. Ordinary JS objects allow writable properties to be redefined to be non-writable. This violates the fixed layout invariant and needs to be disallowed. Also contains a drive-by fix removing @highestInstanceTypeWithinParentClassRange, which is unneeded. Bug: chromium:1407595, v8:12547 Change-Id: I0257fa19f59ccfaaf0e07cb42aeedd71e132d21a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4190525 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#85570} |
||
---|---|---|
.. | ||
cannot-redefine-properties.js | ||
client-gc.js | ||
condition-workers.js | ||
condition.js | ||
mutex-lock-twice.js | ||
mutex-workers.js | ||
mutex.js | ||
non-instance-prototype.js | ||
private-field.js | ||
private-name.js | ||
shared-array-atomics-workers.js | ||
shared-array-atomics.js | ||
shared-array-surface.js | ||
shared-array-workers.js | ||
shared-external-string-dictionary-lookup.js | ||
shared-external-string-megamorphic-ic.js | ||
shared-string-copy-on-share-large.js | ||
shared-string-copy-on-share.js | ||
shared-string-in-code-object.js | ||
shared-string-in-weak-map.js | ||
shared-string-promotion-major.js | ||
shared-string-promotion-minor.js | ||
shared-string.js | ||
shared-struct-atomics-workers.js | ||
shared-struct-atomics.js | ||
shared-struct-property-storage.js | ||
shared-struct-surface.js | ||
shared-struct-workers-optimized-code.js | ||
shared-struct-workers.js | ||
shared-value-barrier-optimization.js | ||
shrink-large-object.js | ||
value-serializer.js |