From 9dc0dfdd03004b56ec2188bbdec533422bddd80d Mon Sep 17 00:00:00 2001
From: Camillo Bruni <cbruni@chromium.org>
Date: Mon, 17 Jan 2022 16:02:38 +0100
Subject: [PATCH] [web snapshot] Verify deserialized objects in tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: v8:11525
Change-Id: I35e582c4ca6da794bab8bce1dfb59e2bb8f0096b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395559
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78654}
---
 test/mjsunit/web-snapshot/web-snapshot.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/test/mjsunit/web-snapshot/web-snapshot.js b/test/mjsunit/web-snapshot/web-snapshot.js
index 50366ff745..b9869ed053 100644
--- a/test/mjsunit/web-snapshot/web-snapshot.js
+++ b/test/mjsunit/web-snapshot/web-snapshot.js
@@ -20,7 +20,10 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   const r2 = Realm.create();
   const success = Realm.useWebSnapshot(r2, snapshot);
   assertTrue(success);
-  return Realm.eval(r2, use, { type: 'function', arguments: [exports] });
+  const result =
+      Realm.eval(r2, use, { type: 'function', arguments: [exports] });
+  %HeapObjectVerify(result);
+  return result;
 }
 
 (function TestMinimal() {