7098f35c7c
This fixes a CHECK failure in MapVerify, and gets the correct behaviour for uses of the well-known symbols. BUG=v8:7611, chromium:866229 R=jkummerow@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org Change-Id: I5d679357b8807ea9d1054121d8d336fe0dd43c7c Reviewed-on: https://chromium-review.googlesource.com/1162278 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Caitlin Potter <caitp@igalia.com> Cr-Commit-Position: refs/heads/master@{#54905}
21 lines
698 B
JavaScript
21 lines
698 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var obj = { length: 1, 0: "spread" };
|
|
obj[Symbol.toStringTag] = "foo";
|
|
obj[Symbol.hasInstance] = function() { return true; }
|
|
obj[Symbol.isConcatSpreadable] = true;
|
|
|
|
var obj2 = { ...obj };
|
|
|
|
// Crash if fast result map bitfield is not set correctly, if verifying heap
|
|
%HeapObjectVerify(obj2);
|
|
|
|
// Ensure correct result for some well-known symbols
|
|
assertEquals("[object foo]", Object.prototype.toString.call(obj2));
|
|
assertTrue(Uint8Array instanceof obj2);
|
|
assertEquals(["spread"], [].concat(obj2));
|