0461a2ac29
Previously, we didn't have access checks for the megamorphic case cause we'd never get to this IC state for a receiver that doesn't hold the right private field. But now with lazy feedback allocation we share the megamorphic case code paths for the uninitialized loads as well, which exposes our bug. Bug: chromium:982702 Change-Id: I419406bcfc52575260a85d05520c1662735e15f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697256 Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#62668}
22 lines
420 B
JavaScript
22 lines
420 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
class A {
|
|
static #foo = 3;
|
|
constructor() {
|
|
print(A.prototype.#foo);
|
|
}
|
|
}
|
|
|
|
assertThrows(() => new A(), TypeError);
|
|
|
|
class B {
|
|
static #foo = 3;
|
|
constructor() {
|
|
B.prototype.#foo = 2;
|
|
}
|
|
}
|
|
|
|
assertThrows(() => new B(), TypeError);
|