f73c57ba7a
This is a follow-up fix for https://chromium-review.googlesource.com/c/v8/v8/+/2292230 In this CL fixes the case when the property cell is added to the dictionary but the value is not actually stored which leaves PropertyCell with the hole in the dictionary. Now the logic for GlobalDictionary matches the logic for NameDictionary - the property cell is added to the dictionary in LookupIterator::ApplyTransitionToDataProperty(). Bug: chromium:1104711, chromium:1105383 Change-Id: I56da16d85d13288fbc41fd60dbce556fec5e7d18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297472 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#68860}
19 lines
523 B
JavaScript
19 lines
523 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
'use strict';
|
|
Object.defineProperty(
|
|
this.__proto__, "boom",
|
|
{ value:153, writable:true, configurable: true, enumerable:false });
|
|
|
|
var good = 1;
|
|
try {
|
|
boom = 42;
|
|
} catch (e) {}
|
|
|
|
var properties = Object.getOwnPropertyNames(this);
|
|
|
|
assertTrue(properties.findIndex(e => e == "good") >= 0);
|
|
assertEquals(properties.findIndex(e => e == "boom"), -1);
|