v8/test/mjsunit/regress/regress-crbug-748539.js
Igor Sheludko 10e4fe3d32 [runtime] Don't create class field types for arrays' fields.
... when generalizing const fields to mutable fields.

Bug: chromium:748539, chromium:747979, chromium:738763
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}
2017-07-27 07:11:05 +00:00

23 lines
407 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f1() {}
function f2() {}
var o1 = [];
o1.a = 0;
o1.f = f1;
%HeapObjectVerify(o1);
var o2 = [];
o2.a = 4.2;
o2.f = f2;
%HeapObjectVerify(o2);
o1.a;
%HeapObjectVerify(o1);
%HeapObjectVerify(o2);