diff options
Diffstat (limited to 'deps/v8/test')
-rw-r--r-- | deps/v8/test/mjsunit/es9/regress/regress-902965.js | 12 | ||||
-rw-r--r-- | deps/v8/test/mjsunit/es9/regress/regress-903070.js | 15 |
2 files changed, 27 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/es9/regress/regress-902965.js b/deps/v8/test/mjsunit/es9/regress/regress-902965.js new file mode 100644 index 0000000000..e2035b242f --- /dev/null +++ b/deps/v8/test/mjsunit/es9/regress/regress-902965.js @@ -0,0 +1,12 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Previously, spreading in-object properties would always treat double fields +// as tagged, potentially dereferencing a Float64. +function inobjectDouble() { + "use strict"; + this.x = -3.9; +} +const instance = new inobjectDouble(); +const clone = { ...instance, }; diff --git a/deps/v8/test/mjsunit/es9/regress/regress-903070.js b/deps/v8/test/mjsunit/es9/regress/regress-903070.js new file mode 100644 index 0000000000..cca02ee0c4 --- /dev/null +++ b/deps/v8/test/mjsunit/es9/regress/regress-903070.js @@ -0,0 +1,15 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +function clone(src) { + return { ...src }; +} + +function inobjectDoubles() { + "use strict"; + this.p0 = -6400510997704731; +} + +// Check that unboxed double is not treated as tagged +assertEquals({ p0: -6400510997704731 }, clone(new inobjectDoubles())); |