v8/test/mjsunit/regress/regress-crbug-897514.js
Camillo Bruni 6c703ffc86 [ic] Respect PropertyDetails::KindField when following transitions
Bug: chromium:897514
Change-Id: Ie7950a2caa2e63e102096a6a36475351259ea854
Reviewed-on: https://chromium-review.googlesource.com/c/1293955
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56870}
2018-10-22 18:46:28 +00:00

27 lines
575 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// Create transtion => 'get a'.
let o = {};
Object.defineProperty(o, 'a', {
enumerable: true,
configurable: true,
get: function() { return 7 }
});
function spread(o) {
let result = { ...o };
%HeapObjectVerify(result);
return result;
}
for (let i = 0; i<3; i++) {
spread([]);
// Use different transition => 'a'.
spread({ a:0 });
spread("abc");
}