v8/test/mjsunit/regress/regress-crbug-851393.js
Igor Sheludko 412ec7539d [builtins] Relax type check in a slow path of Object.assign.
Bug: chromium:851393
Change-Id: I53cbf16068efbf24a2bd233c0b4c56e8361f9931
Reviewed-on: https://chromium-review.googlesource.com/1104317
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53798}
2018-06-18 14:37:38 +00:00

8 lines
259 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var proxy = new Proxy({}, {});
Object.assign(proxy, { b: "boom", 060: "ah", o: "ouch" });