diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc index 5ed726f3387..841eec0edf4 100644 --- a/src/objects/js-objects.cc +++ b/src/objects/js-objects.cc @@ -3867,6 +3867,7 @@ Maybe JSObject::PreventExtensionsWithTransition( } Handle old_map(object->map(), isolate); + old_map = Map::Update(isolate, old_map); TransitionsAccessor transitions(isolate, old_map); Map transition = transitions.SearchSpecial(*transition_marker); if (!transition.is_null()) { diff --git a/test/mjsunit/regress-956426.js b/test/mjsunit/regress-956426.js new file mode 100644 index 00000000000..93ccd7d36db --- /dev/null +++ b/test/mjsunit/regress-956426.js @@ -0,0 +1,10 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +var b = { x: 0, y: 0, 0: '' }; +var a = { x: 0, y: 100000000000, 0: '' }; +Object.seal(b); +b.x = '';