-
Z Nguyen-Huu authored
This code is triggered by Runtime_ArrayIncludes_Slow. The elements kind changes from DICTIONARY (with accessor property using Object.defineProperty) to empty DICTIONARY (by set the length to 0), to frozen/seal/nonextensible elements. This element kind transition happened in accessor property by Array.includes. Bug: v8:9894 Change-Id: I224ceb537ff358a30a6e00414c71d6fe18924bb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876994 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#64575}
65079f10
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |