v8/test/mjsunit/regress/regress-v8-11614.js
jameslahm a544b4967e [runtime] Fix arguments length DCHECK
... in Runtime::kCopyDataPropertiesWithExcludedPropertiesOnStack.

Bug: v8:11614
Change-Id: Ief6d62fff242d3d38c4e586c7252935d3527ddf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3581534
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#79937}
2022-04-12 10:23:15 +00:00

18 lines
663 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// Deconstructing will goto fast path.
const fastProps = { key: "abc", ref: 1234, a: 10, b: 20, c: 30, d: 40, e: 50 };
const { key, ref, ...normalizedFastProps } = fastProps;
// Deconstructing will goto runtime, call
// Runtime:: kCopyDataPropertiesWithExcludedPropertiesOnStack.
// Add a large index to force dictionary elements.
const slowProps = { [2**30] : 10};
assertTrue(%HasDictionaryElements(slowProps));
const { ...normalizedSlowProps } = slowProps;