v8/test/mjsunit/regress/regress-crbug-1195331.js
Igor Sheludko d570bbe0c7 [const-tracking] Generalize constness when delete properties
When fast deleting properties generalize all outgoing transitions
to mutable instead of generalizing when property is reconfigured.

Bug: chromium:1201938
Change-Id: I080f2f43de1691a742be2a2bec5cd20d02d78dbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859960
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74334}
2021-05-03 17:16:36 +00:00

37 lines
1.2 KiB
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
let o1 = { a: 1, b: 0 };
let o2 = { a: 2, b: 0 };
assertTrue(%HaveSameMap(o1, o2));
assertTrue(%HasOwnConstDataProperty(o1, "a"));
assertTrue(%HasOwnConstDataProperty(o1, "b"));
Object.defineProperty(o1, "b", {
value: 4.2, enumerable: true, configurable: true, writable: true,
});
assertFalse(%HaveSameMap(o1, o2));
assertTrue(%HasOwnConstDataProperty(o1, "a"));
assertFalse(%HasOwnConstDataProperty(o1, "b"));
assertTrue(%HasOwnConstDataProperty(o2, "a"));
assertTrue(%HasOwnConstDataProperty(o2, "b"));
let o3 = { a: "foo", b: 0 };
assertFalse(%HaveSameMap(o2, o3));
assertTrue(%HasOwnConstDataProperty(o3, "a"));
assertFalse(%HasOwnConstDataProperty(o3, "b"));
Object.defineProperty(o2, "a", {
value:2, enumerable: false, configurable: true, writable: true,
});
assertTrue(%HasOwnConstDataProperty(o1, "a"));
assertFalse(%HasOwnConstDataProperty(o1, "b"));
assertTrue(%HasOwnConstDataProperty(o3, "a"));
assertFalse(%HasOwnConstDataProperty(o3, "b"));
assertFalse(%HasOwnConstDataProperty(o2, "a"));
assertTrue(%HasOwnConstDataProperty(o2, "b"));