-
Z Nguyen-Huu authored
This DCHECK is unnecessary because the object can be sealed or frozen before it is set as a prototype map. The repro is Object.seal(Object);// Object is HOLEY_FROZEN_ELEMENTS const v3 = Object(); v3.__proto__ = Object; // Set prototype map bit and dictionary map bit const v6 = Object.seal(Object); // Turn Object to DICTIONARY_ELEMENTS Bug: chromium:980168 Change-Id: Iec50249d0ff0c5ed959201707b837871fcb88a02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687280 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#62606}
bf1ab278
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |