v8/test/mjsunit/regress/regress-crbug-1203122-2.js
Marja Hölttä 76adfd1c86 [super ic] Add tests for an already fixed security bug
Bug: chromium:1203122
Change-Id: Ief88320b620dbf2f347bf6f6fc1ebd459e60af3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138194
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76639}
2021-09-02 10:13:06 +00:00

24 lines
521 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function main() {
class A {}
A.prototype.prototype = 'a string';
class C extends A {
m() {
super.prototype;
}
}
function f() {}
// Create handler; receiver is a function.
C.prototype.m.call(f);
// Use handler; receiver not a function.
C.prototype.m.call('not a function');
}
for (let i = 0; i < 100; ++i) {
main();
}