v8/test/mjsunit/regress/regress-crbug-618845.js
jkummerow 3b87e9aa03 Fix stale IC::receiver_map_ after prototype fastification
BUG=chromium:618845

Review-Url: https://codereview.chromium.org/2058063002
Cr-Commit-Position: refs/heads/master@{#36891}
2016-06-10 11:43:33 +00:00

17 lines
478 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function Foo() {}
Object.defineProperty(Foo.prototype, "name",
{get: function() { return "FooName"; }});
function ic(f) {
return f.prototype.name;
}
assertEquals("FooName", ic(Foo));
assertEquals("FooName", ic(Foo)); // Don't crash, don't time out.