diff --git a/src/d8/d8-test.cc b/src/d8/d8-test.cc index 608c0aade5..878693e3c9 100644 --- a/src/d8/d8-test.cc +++ b/src/d8/d8-test.cc @@ -255,11 +255,15 @@ class FastCApiObject { Type sum = 0; for (uint32_t i = 0; i < length; ++i) { - v8::Local element = - seq_arg - ->Get(isolate->GetCurrentContext(), - v8::Integer::NewFromUnsigned(isolate, i)) - .ToLocalChecked(); + v8::MaybeLocal maybe_element = + seq_arg->Get(isolate->GetCurrentContext(), + v8::Integer::NewFromUnsigned(isolate, i)); + if (maybe_element.IsEmpty()) { + isolate->ThrowError("invalid element in JSArray"); + return; + } + + v8::Local element = maybe_element.ToLocalChecked(); if (element->IsNumber()) { double value = element->ToNumber(isolate->GetCurrentContext()) .ToLocalChecked() diff --git a/test/mjsunit/compiler/fast-api-sequences.js b/test/mjsunit/compiler/fast-api-sequences.js index a5d4ccaa9f..8149d59308 100644 --- a/test/mjsunit/compiler/fast-api-sequences.js +++ b/test/mjsunit/compiler/fast-api-sequences.js @@ -318,3 +318,18 @@ for (let i = 0; i < 100; i++) { assert_throws_and_optimized(null_test, null); })(); + +// Passing `null` instead of a TypedArray in a non-overloaded function. +(function () { + function invalid_value() { + const arr = new Array(2); + Object.defineProperty(Array.prototype, 1, { + get() { + throw new 'get is called.'; + } + }); + + fast_c_api.add_all_sequence(false /* should_fallback */, arr); + } + assertThrows(() => invalid_value()); +})();