regress-904167.js 539 Bytes
Newer Older
1 2 3 4 5 6 7 8
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Previously, spreading in-object properties would always treat double fields
// as tagged, potentially dereferencing a Float64.

// Ensure that we don't fail an assert from --verify-heap when cloning a
9
// HeapNumber in the CloneObjectIC handler case.
10 11 12 13 14
var src, clone;
for (var i = 0; i < 40000; i++) {
    src = { ...i, x: -9007199254740991 };
    clone = { ...src };
}