[wasm-gc] Only normalize JSObject targets in SetOrCopyDataProperties

syg · V8 LUCI CQ · commit f320600cd1f4 · 2024-05-09T19:50:44.000Z
Bug: 339458194 Change-Id: I4d6eebdd921971fa28d7c474535d978900ba633f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5527397 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#93811}
diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
@@ -434,9 +434,7 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
       Nothing<bool>());
 
   if (!from->HasFastProperties() && target->HasFastProperties() &&
-      !IsJSGlobalProxy(*target)) {
-    // JSProxy is always in slow-mode.
-    DCHECK(!IsJSProxy(*target));
+      IsJSObject(*target) && !IsJSGlobalProxy(*target)) {
     // Convert to slow properties if we're guaranteed to overflow the number of
     // descriptors.
     int source_length;
