d11292fcff
In strict mode stores to non-existent properties throw. We should not install a handler with the property cell for such stores. These handlers would expect that the value exists when they see a property cell. If this property cell gets invalidated later, it appears as if it is a valid property cell with undefined value. This leads to an incorrect behaviour. This cl checks if we are in strict mode and uses a slow stub in such cases. Bug: chromium:1067757 Change-Id: I543c6a6931530bfb13cc9a33d1dabaa756489fd1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2142255 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#67151}
31 lines
530 B
JavaScript
31 lines
530 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --no-lazy-feedback-allocation
|
|
|
|
"use strict";
|
|
|
|
function foo() {
|
|
let count = 0;
|
|
try {
|
|
for (p of v) {
|
|
count += 1;
|
|
}
|
|
} catch (e) { }
|
|
assertEquals(count, 0);
|
|
}
|
|
|
|
var v = [ "0", {}];
|
|
|
|
foo();
|
|
Reflect.deleteProperty(v, '0');
|
|
|
|
let count_loop = 0;
|
|
try {
|
|
for (p of v) { count_loop += 1; }
|
|
} catch (e) {}
|
|
assertEquals(count_loop, 0);
|
|
|
|
foo();
|