v8/test/mjsunit/regress/regress-crbug-778952.js
Jakob Kummerow a5b0d640c2 Fix DCHECK in HasFastProperties
Objects with both dictionary and non-dictionary maps can store their
hash in the {properties} field when they have no other properties.

Bug: chromium:778952
Change-Id: I8ac8c31eaac32116415e3c65cef8dee260dca2c9
Reviewed-on: https://chromium-review.googlesource.com/747272
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49056}
2017-10-31 18:06:43 +00:00

10 lines
297 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function() {
const p = new Proxy({}, {});
(new Set).add(p); // Compute the hash code for p.
null[p] = 0;
});