mirror of https://github.com/electron/electron
28 lines
1.2 KiB
Diff
28 lines
1.2 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Shu-yu Guo <syg@chromium.org>
|
|
Date: Thu, 9 May 2024 12:03:28 -0700
|
|
Subject: Only normalize JSObject targets in SetOrCopyDataProperties
|
|
|
|
Bug: 339458194
|
|
Change-Id: I4d6eebdd921971fa28d7c474535d978900ba633f
|
|
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5527397
|
|
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
|
|
Commit-Queue: Shu-yu Guo <syg@chromium.org>
|
|
Cr-Commit-Position: refs/heads/main@{#93811}
|
|
|
|
diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
|
|
index 32e1e89fc53217fe188c1f764bd97c03dadf35a2..0381a9f65a9e6cdfb30881077e4a442cd2a10802 100644
|
|
--- a/src/objects/js-objects.cc
|
|
+++ b/src/objects/js-objects.cc
|
|
@@ -429,9 +429,7 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
|
|
Nothing<bool>());
|
|
|
|
if (!from->HasFastProperties() && target->HasFastProperties() &&
|
|
- !IsJSGlobalProxy(*target)) {
|
|
- // JSProxy is always in slow-mode.
|
|
- DCHECK(!IsJSProxy(*target));
|
|
+ IsJSObject(*target) && !IsJSGlobalProxy(*target)) {
|
|
// Convert to slow properties if we're guaranteed to overflow the number of
|
|
// descriptors.
|
|
int source_length;
|