659010ec71
The path for sealed elements is handled by using the same path for SmiOrObjectElementKind, just need to extend a DCHECK in CodeStubAssembler::IsFixedArrayWithKind. The only special case is when we write to a hole in holey sealed elements. Since we can not write in that case, just bail out. Bug: chromium:967101 Change-Id: Ibf837ae053fe609bca83da432f298ef056f3aced Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632830 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#62071}
49 lines
838 B
JavaScript
49 lines
838 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// For packed sealed object.
|
|
function packedStore() {
|
|
let a = Object.seal([""]);
|
|
a[0] = 0;
|
|
assertEquals(a[0], 0);
|
|
}
|
|
|
|
packedStore();
|
|
packedStore();
|
|
|
|
// For holey sealed object.
|
|
function holeyStore() {
|
|
let a = Object.seal([, ""]);
|
|
a[0] = 0;
|
|
assertEquals(a[0], undefined);
|
|
}
|
|
|
|
holeyStore();
|
|
holeyStore();
|
|
|
|
// Make sure IC store for holey is consistent.
|
|
let a = Object.seal([, ""]);
|
|
function foo() {
|
|
a[1] = 0;
|
|
}
|
|
|
|
foo();
|
|
foo();
|
|
function bar() {
|
|
a[0] = 1;
|
|
}
|
|
assertEquals(a, [, 0]);
|
|
bar();
|
|
assertEquals(a, [, 0]);
|
|
bar();
|
|
assertEquals(a, [, 0]);
|
|
function baz() {
|
|
a[2] = 2;
|
|
}
|
|
assertEquals(a, [, 0]);
|
|
baz();
|
|
assertEquals(a, [, 0]);
|
|
baz();
|
|
assertEquals(a, [, 0]);
|