v8/test/mjsunit/regress/regress-crbug-881247.js
Camillo Bruni 78e5763181 [CloneObjectIC] Avoid FieldType confusions
Do not propagate FieldTypes for kField properties.

Bug: chromium:881247
Change-Id: Ia6af451cd6f3ba22a9ced1f3b43fc4cfc8f7084e
Reviewed-on: https://chromium-review.googlesource.com/c/1288637
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56813}
2018-10-19 11:03:21 +00:00

25 lines
564 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const resolvedPromise = Promise.resolve();
function spread() {
const result = { ...resolvedPromise };
%HeapObjectVerify(result);
return result;
}
resolvedPromise[undefined] = {a:1};
%HeapObjectVerify(resolvedPromise);
spread();
resolvedPromise[undefined] = undefined;
%HeapObjectVerify(resolvedPromise);
spread();
%HeapObjectVerify(resolvedPromise);