36e80d3833
The fast store handlers create elements and if we have a typed array on the prototype chain it is not easy to check when it is OK to create new elements. The TypedArrays swallow all OOB stores, and there is no easy way to check if the current store is OOB for JSObjects. So use slow stub when there are typed arrays on the prorotype chain of JSObjects. Bug: chromium:1068492 Change-Id: I9eea9cf00e3eb84931c5545d18ba53c4ec39f353 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134138 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#67226}
17 lines
367 B
JavaScript
17 lines
367 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --no-lazy-feedback-allocation
|
|
|
|
|
|
v = {};
|
|
v.__proto__ = new Int32Array(1);
|
|
function foo() {
|
|
for (var i = 0; i < 2; i++) {
|
|
v[i] = 0;
|
|
}
|
|
}
|
|
foo();
|
|
assertEquals(Object.keys(v).length, 1);
|