fbcf0221fa
The CSA implementation is a separate handler so that TF has the opportunity to reduce to a direct call, skipping some of the dispatching in the CloneObjectIC stub. This patch moves the looping over a source object's keys and values into the base CodeStubAssembler, so that it can be shared between ObjectAssignFast and CloneObjectIC_Slow. During each step of the loop, storing is delegated to a new SetPropertyInLiteral helper in KeyedStoreGenericGenerator, which performs a store without consulting the prototype chain, and automatically reconfigures accessors into data properties regardless of their attributes. BUG=v8:8067, v8:7611 R=ishell@chromium.org, jkummerow@chromium.org Change-Id: I06ae89f37e9b4265aab67389cf68a96529f90578 Reviewed-on: https://chromium-review.googlesource.com/1182122 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#55806}
27 lines
862 B
JavaScript
27 lines
862 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
(function testMegamorphicWithDontEnumTransition() {
|
|
function spread(o) { return { ...o }; }
|
|
|
|
// Set up transition tree
|
|
let obj = { ...{}, a: 0, b: 1, c: 2, };
|
|
Object.defineProperty(obj, "boom", { enumerable: false, configurable: true,
|
|
writable: true });
|
|
|
|
// make CloneObjectIC MEGAMORPHIC
|
|
spread(new Proxy({}, {}));
|
|
|
|
// Ensure we don't crash, and create the correct object
|
|
let result = spread({ a: 0, b: 1, c: 2, boom: 3 });
|
|
|
|
assertEquals({ a: 0, b: 1, c: 2, boom: 3 }, result);
|
|
assertEquals({
|
|
enumerable: true,
|
|
writable: true,
|
|
configurable: true,
|
|
value: 3,
|
|
}, Object.getOwnPropertyDescriptor(result, "boom"));
|
|
})();
|