[ic] Fix accessor to data reconfiguration case

... in object literals. Bug: chromium:997056 Change-Id: Ifc210ff53b751c6ef26f16b73c9ac52426a845fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813021 Reviewed-by: Toon Verwaest <[email protected]> Commit-Queue: Igor Sheludko <[email protected]> Cr-Commit-Position: refs/heads/master@{#63894}
couchbasedeps · Sep 19, 2019 · ecafe04 · ecafe04
1 parent f02b27a
commit ecafe04
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/src/ic/keyed-store-generic.cc b/src/ic/keyed-store-generic.cc
@@ -810,7 +810,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
         var_accessor_holder = receiver;
         Goto(&accessor);
       } else {
-        Goto(&data_property);
+        // Handle accessor to data property reconfiguration in runtime.
+        Goto(slow);
       }
 
       BIND(&data_property);

diff --git a/test/mjsunit/regress/regress-crbug-997056.js b/test/mjsunit/regress/regress-crbug-997056.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (let i = 0; i < 4; ++i) {
+    var obj1 = {
+        get [obj1]() {},
+        ...obj2,
+    };
+    var obj2 = { [obj1]: 0 };
+    print(obj2);
+}