diff --git a/src/ic/keyed-store-generic.cc b/src/ic/keyed-store-generic.cc index 97cd0f103989..ff830a022e5b 100644 --- a/src/ic/keyed-store-generic.cc +++ b/src/ic/keyed-store-generic.cc @@ -810,7 +810,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore( var_accessor_holder = receiver; Goto(&accessor); } else { - Goto(&data_property); + // Handle accessor to data property reconfiguration in runtime. + Goto(slow); } BIND(&data_property); diff --git a/test/mjsunit/regress/regress-crbug-997056.js b/test/mjsunit/regress/regress-crbug-997056.js new file mode 100644 index 000000000000..02e2772ddb82 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-997056.js @@ -0,0 +1,12 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +for (let i = 0; i < 4; ++i) { + var obj1 = { + get [obj1]() {}, + ...obj2, + }; + var obj2 = { [obj1]: 0 }; + print(obj2); +}