diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-1012301.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-1012301.js | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js b/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js new file mode 100644 index 0000000000..dc2ef92a6f --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js @@ -0,0 +1,23 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --allow-natives-syntax + +function f(o) { + // The spread after the CloneObject IC shouldn't crash when trying to write a + // double value to a field created by CloneObject. + return {...o, ...{a:1.4}}; +} + +%EnsureFeedbackVectorForFunction(f); + +var o = {}; +// Train the CloneObject IC with a Double field. +o.a = 1.5; +f(o); +f(o); +f(o); +// Change the source map to have a Tagged field. +o.a = undefined; +f(o); |