v8/test/mjsunit/regress/regress-crbug-436820.js
ishell 1a2e4b265a Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map.
BUG=chromium:436820
LOG=N

Review URL: https://codereview.chromium.org/759823004

Cr-Commit-Position: refs/heads/master@{#25530}
2014-11-26 17:37:05 +00:00

14 lines
334 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function c(p) {
return {__proto__: p};
}
var p = {};
var o = c(p);
p.x = 0.6;
Object.defineProperty(p, "x", { writable: false });