diff options
author | Michaël Zasso <targos@protonmail.com> | 2019-11-08 15:39:11 +0100 |
---|---|---|
committer | Michaël Zasso <targos@protonmail.com> | 2019-11-08 15:46:25 +0100 |
commit | 6ca81ad72a3c6fdf16c683335be748f22aaa9a0d (patch) | |
tree | 33c8ee75f729aed76c2c0b89c63f9bf1b4dd66aa /deps/v8/test/mjsunit/regress/regress-crbug-1012301.js | |
parent | 1eee0b8bf8bba39b600fb16a9223e545e3bac2bc (diff) | |
download | android-node-v8-6ca81ad72a3c6fdf16c683335be748f22aaa9a0d.tar.gz android-node-v8-6ca81ad72a3c6fdf16c683335be748f22aaa9a0d.tar.bz2 android-node-v8-6ca81ad72a3c6fdf16c683335be748f22aaa9a0d.zip |
deps: update V8 to 7.9.317.20
PR-URL: https://github.com/nodejs/node/pull/30020
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-1012301.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-1012301.js | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js b/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js new file mode 100644 index 0000000000..dc2ef92a6f --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js @@ -0,0 +1,23 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --allow-natives-syntax + +function f(o) { + // The spread after the CloneObject IC shouldn't crash when trying to write a + // double value to a field created by CloneObject. + return {...o, ...{a:1.4}}; +} + +%EnsureFeedbackVectorForFunction(f); + +var o = {}; +// Train the CloneObject IC with a Double field. +o.a = 1.5; +f(o); +f(o); +f(o); +// Change the source map to have a Tagged field. +o.a = undefined; +f(o); |