node/deps/v8/test/mjsunit/regress/regress-crbug-1012301.js
Michaël Zasso 6ca81ad72a
deps: update V8 to 7.9.317.20
PR-URL: https://github.com/nodejs/node/pull/30020
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2019-11-08 15:46:25 +01:00

24 lines
585 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
function f(o) {
// The spread after the CloneObject IC shouldn't crash when trying to write a
// double value to a field created by CloneObject.
return {...o, ...{a:1.4}};
}
%EnsureFeedbackVectorForFunction(f);
var o = {};
// Train the CloneObject IC with a Double field.
o.a = 1.5;
f(o);
f(o);
f(o);
// Change the source map to have a Tagged field.
o.a = undefined;
f(o);