v8/test/mjsunit/regress/regress-crbug-731193.js
Toon Verwaest 2325ef535f [ic] Fix stub-cached access to use the dereffed thin-string.
If we pass in thin-string into a keyed load, the underlying internalized string is used to find the handler. However, the thin string itself was used to interpret the handler. Since the thin string itself isn't unique, this caused existing properties on the prototype chain to not be found in case of dictionary-mode prototypes.

Bug: chromium:731193
Change-Id: Ic98d3789ecf9175e17d9c898ab13231aad59efcc
Reviewed-on: https://chromium-review.googlesource.com/539596
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46005}
2017-06-19 13:33:19 +00:00

28 lines
577 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {
}
// Make prototype of f go dictionary-mode.
for (var i = 0; i < 10000; i++) {
f.prototype["b" + i] = 1;
}
var o = new f();
function access(o, k) {
return o[k];
}
// Create a thin string.
var p = "b";
p += 10001;
assertEquals(undefined, access(o, p));
assertEquals(undefined, access(o, p));
assertEquals(undefined, access(o, p));
f.prototype[p] = 100;
assertEquals(100, access(o, p));