v8/test/mjsunit/regress/regress-crbug-979023.js
Leszek Swirski f690334b7f [ic] Fix accessor set after map update transitioning to dict
Bug: chromium:979023
Change-Id: Ief42ed100478c0b741051a5ca123dc807e2a6dca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687671
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62501}
2019-07-03 10:00:17 +00:00

19 lines
439 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo(arg) {
var ret = { x: arg };
Object.defineProperty(ret, "y", {
get: function () { },
configurable: true
});
return ret;
}
let v0 = foo(10);
let v1 = foo(10.5);
Object.defineProperty(v0, "y", {
get: function () { },
configurable: true
});