v8/test/mjsunit/regress/regress-crbug-1050046.js
Toon Verwaest 4b0916a2bc [keys] Make sure we don't leak the enum cache in slow-mode for/in
An enum cache can only be referenced together with the map that owns the
entries that are needed. Otherwise the entires can be trimmed away if
the map dies because of transitions.

Bug: chromium:1050046
Change-Id: I5bc9dd65ca092c3d5ebc08ce553f6f1dc980d41b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2066959
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66375}
2020-02-20 16:44:41 +00:00

14 lines
309 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var __v_6 = new Boolean();
__v_6.first = 0;
__v_6.prop = 1;
for (var __v_2 in __v_6) {
delete __v_6.prop;
gc();
}