• Z Nguyen-Huu's avatar
    Remove unnecessary DCHECK · bf1ab278
    Z Nguyen-Huu authored
    This DCHECK is unnecessary because the object can be sealed or frozen
    before it is set as a prototype map.
    
    The repro is
    Object.seal(Object);// Object is HOLEY_FROZEN_ELEMENTS
    const v3 = Object();
    v3.__proto__ = Object; // Set prototype map bit and dictionary map bit
    const v6 = Object.seal(Object); // Turn Object to DICTIONARY_ELEMENTS
    
    Bug: chromium:980168
    Change-Id: Iec50249d0ff0c5ed959201707b837871fcb88a02
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687280
    Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
    Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62606}
    bf1ab278
js-objects.cc 223 KB