From 300f9e85d0358ef57e98d9b97a36de728f349d44 Mon Sep 17 00:00:00 2001
From: xurui <xurui115@h-partners.com>
Date: Sun, 19 May 2024 15:44:32 +0800
Subject: [PATCH] =?UTF-8?q?fixed=2001c9890=20from=20https://gitee.com/clea?=
 =?UTF-8?q?r=5Faddr/chromium=5Fv8/pulls/50=20=E4=BF=AE=E5=A4=8DCVE-2024-47?=
 =?UTF-8?q?61?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: xurui <xurui115@h-partners.com>
---
 src/objects/js-objects.cc | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
index 463bc42d4..87feeda6a 100644
--- a/src/objects/js-objects.cc
+++ b/src/objects/js-objects.cc
@@ -360,9 +360,7 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
       Nothing<bool>());
 
   if (!from->HasFastProperties() && target->HasFastProperties() &&
-      !target->IsJSGlobalProxy()) {
-    // JSProxy is always in slow-mode.
-    DCHECK(!target->IsJSProxy());
+      target->IsJSObject() && !target->IsJSGlobalProxy()) {
     // Convert to slow properties if we're guaranteed to overflow the number of
     // descriptors.
     int source_length;
-- 
Gitee