Skip to content

Commit

Permalink
deps: patch V8 to 7.0.276.36
Browse files Browse the repository at this point in the history
Refs: v8/v8@7.0.276.35...7.0.276.36

PR-URL: #24109
Reviewed-By: Ali Ijaz Sheikh <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Refael Ackermann <[email protected]>
  • Loading branch information
targos authored and BridgeAR committed Nov 13, 2018
1 parent 3179011 commit 566399e
Show file tree
Hide file tree
Showing 3 changed files with 35 additions and 4 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 7
#define V8_MINOR_VERSION 0
#define V8_BUILD_NUMBER 276
#define V8_PATCH_LEVEL 35
#define V8_PATCH_LEVEL 36

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
13 changes: 10 additions & 3 deletions deps/v8/src/objects.cc
Original file line number Diff line number Diff line change
Expand Up @@ -10266,15 +10266,22 @@ Handle<DescriptorArray> DescriptorArray::CopyForFastObjectClone(
Name* key = src->GetKey(i);
PropertyDetails details = src->GetDetails(i);

SLOW_DCHECK(!key->IsPrivateField() && details.IsEnumerable() &&
details.kind() == kData);
DCHECK(!key->IsPrivateField());
DCHECK(details.IsEnumerable());
DCHECK_EQ(details.kind(), kData);

// Ensure the ObjectClone property details are NONE, and that all source
// details did not contain DONT_ENUM.
PropertyDetails new_details(kData, NONE, details.location(),
details.constness(), details.representation(),
details.field_index());
descriptors->Set(i, key, src->GetValue(i), new_details);
// Do not propagate the field type of normal object fields from the
// original descriptors since FieldType changes don't create new maps.
MaybeObject* type = src->GetValue(i);
if (details.location() == PropertyLocation::kField) {
type = MaybeObject::FromObject(FieldType::Any());
}
descriptors->Set(i, key, type, new_details);
}

descriptors->Sort();
Expand Down
24 changes: 24 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-crbug-881247.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

const resolvedPromise = Promise.resolve();

function spread() {
const result = { ...resolvedPromise };
%HeapObjectVerify(result);
return result;
}

resolvedPromise[undefined] = {a:1};
%HeapObjectVerify(resolvedPromise);

spread();

resolvedPromise[undefined] = undefined;
%HeapObjectVerify(resolvedPromise);

spread();
%HeapObjectVerify(resolvedPromise);

0 comments on commit 566399e

Please sign in to comment.